TL;DR: A path traversal vulnerability in Nozomi Arc before v2.7.0 lets any administrator of the local web interface delete arbitrary files on the appliance by submitting a crafted archive name. The Arc process runs with administrative privileges, so the deletion reaches files it should never touch. Fixed in version 2.7.0.

What happened

The Offline archives feature in Nozomi Arc's local web interface accepts an archive name from the user. The application passes that name to file operations without stripping directory traversal sequences. When an administrator submits a name like ../../../etc/important_config, the path resolves outside the intended archives directory and points at an arbitrary location on the filesystem.

The archive operation then deletes the file at that resolved path. Because the Arc service runs with administrative privileges on the host operating system, the deletion succeeds against any file the admin-level process can reach. That includes system configuration files, log files, database files, and binaries that keep the appliance running.

The attack requires valid administrative credentials for Arc's local web interface. An external attacker with no access to the appliance cannot trigger this. The threat model is a compromised admin account, a malicious insider, or an attacker who has already gained a foothold through another vector and escalates to destructive file access beyond what the web UI should expose.

Who is affected

Nozomi Networks Arc is a security platform for operational technology (OT) and industrial control systems (ICS). Organizations deploy Arc appliances inside their industrial networks to discover assets, monitor for threats, and assess vulnerabilities across SCADA systems, PLCs, DNP3 devices, and other field equipment. Nozomi Networks serves thousands of enterprise customers in energy, manufacturing, pharmaceuticals, oil and gas, water utilities, and transportation. Their customer base includes Fortune 500 industrial operators and critical infrastructure providers.

All Arc versions before 2.7.0 are affected. Any deployment where an administrator account could be compromised or abused is at risk. The path traversal lets that admin destroy files the Arc platform depends on, potentially taking the security monitoring appliance itself offline in environments where continuous OT visibility is a compliance requirement.

What to do

Upgrade to Arc v2.7.0 or later. The fix adds proper input validation on archive names submitted through the Offline archives interface, rejecting paths that contain traversal sequences.

If you cannot upgrade immediately, restrict access to the Arc local web interface to a small set of trusted administrator workstations using network segmentation. Rotate administrative credentials for the Arc web interface. Monitor for unexpected file deletion or service instability on Arc appliances, which could indicate exploitation of this or another destructive access vector.

Why it matters

OT security platforms sit in a privileged position. They observe traffic across industrial networks and often have deep access to the systems they monitor. A vulnerability that lets a compromised admin delete arbitrary files on the security appliance itself is a double risk: it can blind the organization's OT visibility, and it can cascade into broader operational disruption if the deleted files are critical to other integrated systems.

Industrial environments typically have lower tolerance for downtime than enterprise IT. Deleting the wrong configuration or binary on an Arc appliance in a power plant or factory floor could halt monitoring during an active incident, exactly when visibility matters most.

References

• hol.org CVE record
• Nozomi Networks