Incorrect authorization for traces request/download in CMC before 25.1.0
Priority LOW 23CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed CMC (Nozomi Networks): 25.1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nozomi Networks | CMC | before 25.1.0 | 25.1.0 | Patch available | CNA |
- CMC VendorNozomi Networks Affected before 25.1.0 Fixed in 25.1.0 Patch available CNA
Remediation
- Fix · CNA CMC (Nozomi Networks) Fixed in 25.1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1501
- 2026-10-03 Alias added: GHSA-hqgg-q83j-h468
References
More Nozomi Networks vulnerabilities
- TI-2022-00470 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 CVSS 4.0HIGH 8.6
- TI-2026-24526 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 CVSS 4.0HIGH 8.7
- TI-2023-15926 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0HIGH 8.2
- TI-2023-13657 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0CRITICAL 9.2
- TI-2024-00196 DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 CVSS 4.0HIGH 8.2
- TI-2021-08402 Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 CVSS 4.0HIGH 8.6
Sources
- CVE-2025-1501 · CVE Program
- CVE-2025-1501 · NVD
- FIRST EPSS
- GHSA-hqgg-q83j-h468 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences