CVE-2025-40896

The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.nozominetworks.com/NN-2025:18-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nozominetworks:arc:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:22

Type	Values Removed	Values Added
Summary		(es) El certificado del servidor no se verificó cuando un agente Arc se conectó a un Guardian o CMC. Un actor malicioso podría realizar un ataque man-in-the-middle e interceptar la comunicación entre el agente Arc y el Guardian o CMC. Esto podría resultar en el robo del token del cliente e información sensible (como activos y alertas), la suplantación del servidor, o la inyección de datos falsificados (como información falsa de activos o vulnerabilidades) en el Guardian o CMC.

05 Mar 2026, 18:48

Type	Values Removed	Values Added
References	~~() https://security.nozominetworks.com/NN-2025:18-01 -~~	() https://security.nozominetworks.com/NN-2025:18-01 - Vendor Advisory
First Time		Nozominetworks Nozominetworks arc
CPE		cpe:2.3:a:nozominetworks:arc::::::::

04 Mar 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-04 14:16

Updated : 2026-06-17 09:22

NVD link : CVE-2025-40896

Mitre link : CVE-2025-40896

CVE.ORG link : CVE-2025-40896

JSON object : View

Products Affected

nozominetworks

arc

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-40896", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40896", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T14:11:20.778867Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "prodsec@nozominetworks.com", "affectedData": [{"vendor": "Nozomi Networks", "product": "Arc", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-04T14:16:14.143", "references": [{"url": "https://security.nozominetworks.com/NN-2025:18-01", "tags": ["Vendor Advisory"], "source": "prodsec@nozominetworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "The server certificate was not verified when an Arc agent connected to a Guardian or CMC.\n\n\n\nA malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC."}, {"lang": "es", "value": "El certificado del servidor no se verific\u00f3 cuando un agente Arc se conect\u00f3 a un Guardian o CMC.\n\nUn actor malicioso podr\u00eda realizar un ataque man-in-the-middle e interceptar la comunicaci\u00f3n entre el agente Arc y el Guardian o CMC. Esto podr\u00eda resultar en el robo del token del cliente e informaci\u00f3n sensible (como activos y alertas), la suplantaci\u00f3n del servidor, o la inyecci\u00f3n de datos falsificados (como informaci\u00f3n falsa de activos o vulnerabilidades) en el Guardian o CMC."}], "lastModified": "2026-06-17T09:22:14.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nozominetworks:arc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C7E6F5B-E490-4F40-A88E-F9D8A251CB7A", "versionEndExcluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@nozominetworks.com"}