What’s Vulnerable › Vulnerabilities
CVE-2025-1501: Incorrect authorization for traces request/download in CMC before 25.1.0
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-26 · updated 2026-06-17
- Weakness: CWE-863
Description
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.
Affected products
- Nozomi Networks CMC: before 25.1.0 — fixed in 25.1.0
How to fix
Upgrade to a fixed version: Nozomi Networks CMC 25.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-1501 or the next vulnerability affects your stack