High severity7.9NVD Advisory· Published Oct 7, 2025· Updated Apr 29, 2026

CVE-2025-3718

Description

A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.

Affected products

Nozominetworks/Cmc
cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*
Range: <25.2.0
Nozominetworks/Guardian
cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*
Range: <25.2.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

security.nozominetworks.com/NN-2025:4-01nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.514
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000