Description
A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nozomi Networks | Guardian | < 25.2.0 | 25.2.0 |
| Nozomi Networks | CMC | < 25.2.0 | 25.2.0 |
Advisories 2
- ICSA-25-226-09 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Jan 14, 2026
- SSA-978177 SSA-978177: Vulnerability in Nozomi Guardian/CMC Before 25.4.0 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026