CVE-2025-3718: medium-severity vulnerability in Nozomi Networks Guardian
Client-side path traversal in Guardian/CMC before 25.2.0
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.8epss 0.2%
A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L
Related CVEs — Nozomi Networks Guardian
In the same product, most dangerous first.
CVE-2021-26724HIGHAuthenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4EPSS 2.8%CVE-2026-33924HIGHAuthenticated RCE in update functionality in Guardian/CMC before 26.4.0EPSS 1.1%CVE-2021-26725HIGHAuthenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4EPSS 1.1%CVE-2024-13089HIGHAuthenticated RCE in update functionality in Guardian/CMC before 24.6.0EPSS 1.1%CVE-2022-0551HIGHAuthenticated RCE on project configuration import in Guardian/CMC before 22.0.0EPSS 0.9%CVE-2022-0550HIGHAuthenticated RCE on logo report upload in Guardian/CMC before 22.0.0EPSS 0.9%