Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-40465 (GCVE-0-2026-40465)

Vulnerability from nvd – Published: 2026-08-31 06:37 – Updated: 2026-08-31 15:33

Title

An Open Re-direct Vulnerability in Nokia NSP

Summary

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:32 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	NSP	Affected: 23.11 Affected: 24.4 Affected: 24.8 Affected: 24.11 Affected: 25.4 Affected: 25.8 Affected: 25.11 Unaffected: NSP 24.11-SP15 Unaffected: NSP 25.11-SP5 Unaffected: NSP 26.4 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:32:50.443352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T15:33:24.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NSP",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "23.11"
            },
            {
              "status": "affected",
              "version": "24.4"
            },
            {
              "status": "affected",
              "version": "24.8"
            },
            {
              "status": "affected",
              "version": "24.11"
            },
            {
              "status": "affected",
              "version": "25.4"
            },
            {
              "status": "affected",
              "version": "25.8"
            },
            {
              "status": "affected",
              "version": "25.11"
            },
            {
              "status": "unaffected",
              "version": "NSP 24.11-SP15"
            },
            {
              "status": "unaffected",
              "version": "NSP 25.11-SP5"
            },
            {
              "status": "unaffected",
              "version": "NSP 26.4 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:37:19.360Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/"
        }
      ],
      "title": "An Open Re-direct Vulnerability in Nokia NSP",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40465",
    "datePublished": "2026-08-31T06:37:19.360Z",
    "dateReserved": "2026-04-13T11:28:52.517Z",
    "dateUpdated": "2026-08-31T15:33:24.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40464 (GCVE-0-2026-40464)

Vulnerability from nvd – Published: 2026-08-31 06:35 – Updated: 2026-08-31 14:33

Title

A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP

Summary

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 14:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	NSP	Affected: 22.3 Affected: 22.6 Affected: 22.9 Affected: 22.11 Affected: 23.4 Affected: 23.8 Affected: 23.11 Affected: 24.4 Affected: 24.8 Affected: 24.11 Affected: 25.4 Affected: 25.8 Affected: 25.11 Unaffected: 24.11-SP15 Unaffected: 25.11-SP5 Unaffected: NSP 26.4 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:33:28.174760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:33:52.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NSP",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "22.3"
            },
            {
              "status": "affected",
              "version": "22.6"
            },
            {
              "status": "affected",
              "version": "22.9"
            },
            {
              "status": "affected",
              "version": "22.11"
            },
            {
              "status": "affected",
              "version": "23.4"
            },
            {
              "status": "affected",
              "version": "23.8"
            },
            {
              "status": "affected",
              "version": "23.11"
            },
            {
              "status": "affected",
              "version": "24.4"
            },
            {
              "status": "affected",
              "version": "24.8"
            },
            {
              "status": "affected",
              "version": "24.11"
            },
            {
              "status": "affected",
              "version": "25.4"
            },
            {
              "status": "affected",
              "version": "25.8"
            },
            {
              "status": "affected",
              "version": "25.11"
            },
            {
              "status": "unaffected",
              "version": "24.11-SP15"
            },
            {
              "status": "unaffected",
              "version": "25.11-SP5"
            },
            {
              "status": "unaffected",
              "version": "NSP 26.4 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:35:32.425Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40464/"
        }
      ],
      "title": "A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40464",
    "datePublished": "2026-08-31T06:35:32.425Z",
    "dateReserved": "2026-04-13T11:28:52.516Z",
    "dateUpdated": "2026-08-31T14:33:52.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40463 (GCVE-0-2026-40463)

Vulnerability from nvd – Published: 2026-08-31 06:32 – Updated: 2026-08-31 15:36

Title

An Insufficient Role-based Access Control Vulnerability in WaveSuite

Summary

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:36 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	WaveSuite	Affected: 25.6 Affected: 24.12 Affected: 24.6 Affected: 23.6 Unaffected: 25.12FP1 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:36:13.476760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T15:36:24.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WaveSuite",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "25.6"
            },
            {
              "status": "affected",
              "version": "24.12"
            },
            {
              "status": "affected",
              "version": "24.6"
            },
            {
              "status": "affected",
              "version": "23.6"
            },
            {
              "status": "unaffected",
              "version": "25.12FP1 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:32:25.491Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40463/"
        }
      ],
      "title": "An Insufficient Role-based Access Control Vulnerability in WaveSuite",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40463",
    "datePublished": "2026-08-31T06:32:25.491Z",
    "dateReserved": "2026-04-13T11:28:52.516Z",
    "dateUpdated": "2026-08-31T15:36:24.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7406 (GCVE-0-2025-7406)

Vulnerability from nvd – Published: 2026-06-30 08:59 – Updated: 2026-06-30 13:31

Title

A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:31 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <NM 25R1-NM Unaffected: ≥NM 25R1-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7406",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:31:19.958711Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:31:51.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003cNM 25R1-NM"
            },
            {
              "status": "unaffected",
              "version": "\u2265NM 25R1-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T08:59:58.941Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-7406/"
        }
      ],
      "title": "A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-7406",
    "datePublished": "2026-06-30T08:59:58.941Z",
    "dateReserved": "2025-07-10T06:10:12.822Z",
    "dateUpdated": "2026-06-30T13:31:51.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24816 (GCVE-0-2025-24816)

Vulnerability from nvd – Published: 2026-06-30 08:58 – Updated: 2026-06-30 13:30

Title

An Improper Access Control vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:30 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <25R2-NM Unaffected: ≥25R2-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:30:08.532062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:30:45.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T11:40:27.463Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
        }
      ],
      "title": "An Improper Access Control vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24816",
    "datePublished": "2026-06-30T08:58:29.484Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-06-30T13:30:45.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24815 (GCVE-0-2025-24815)

Vulnerability from nvd – Published: 2026-06-30 08:55 – Updated: 2026-06-30 13:29

Title

An unrestricted file upload vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:28 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <25R2-NM Unaffected: ≥25R2-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:28:43.371983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:29:34.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T11:40:20.157Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24815/"
        }
      ],
      "title": "An unrestricted file upload vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24815",
    "datePublished": "2026-06-30T08:55:42.078Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-06-30T13:29:34.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-9912 (GCVE-0-2025-9912)

Vulnerability from nvd – Published: 2026-06-16 05:58 – Updated: 2026-06-16 12:28

Title

A local privilege escalation vulnerability in Nokia SR Linux

Summary

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 12:28 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

2 products

Vendor	Product	Version
Nokia	Nokia SR Linux	Affected: < 23.10.8 Affected: < 24.10.6 Affected: < 25.7.2
Nokia	Nokia SR Linux	Unaffected: 23.10.8 Unaffected: 24.10.6 Unaffected: 25.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-9912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T12:28:34.738391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T12:28:56.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Nokia SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 23.10.8"
            },
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            },
            {
              "status": "affected",
              "version": "\u003c 25.7.2"
            }
          ]
        },
        {
          "product": "Nokia SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.10.8"
            },
            {
              "status": "unaffected",
              "version": "24.10.6"
            },
            {
              "status": "unaffected",
              "version": "25.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T05:58:02.543Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-9912/"
        }
      ],
      "title": "A local privilege escalation vulnerability in Nokia SR Linux",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-9912",
    "datePublished": "2026-06-16T05:58:02.543Z",
    "dateReserved": "2025-09-03T08:58:21.602Z",
    "dateUpdated": "2026-06-16T12:28:56.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-10262 (GCVE-0-2025-10262)

Vulnerability from nvd – Published: 2026-06-16 05:40 – Updated: 2026-06-16 12:32

Title

An unsanitized format validation vulnerability in Nokia SR Linux

Summary

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 12:31 UTC

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

2 products

Vendor	Product	Version
Nokia	SR Linux	Affected: < 23.10.8 Affected: < 24.10.6 Affected: < 25.7.2
Nokia	SR Linux	Unaffected: 23.10.8 Unaffected: 24.10.6 Unaffected: 25.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-10262",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T12:31:09.043017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-134",
                "description": "CWE-134 Use of Externally-Controlled Format String",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T12:32:54.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 23.10.8"
            },
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            },
            {
              "status": "affected",
              "version": "\u003c 25.7.2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.10.8"
            },
            {
              "status": "unaffected",
              "version": "24.10.6"
            },
            {
              "status": "unaffected",
              "version": "25.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T05:58:15.720Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-10262/"
        }
      ],
      "title": "An unsanitized format validation vulnerability in Nokia SR Linux",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-10262",
    "datePublished": "2026-06-16T05:40:23.769Z",
    "dateReserved": "2025-09-11T08:45:07.544Z",
    "dateUpdated": "2026-06-16T12:32:54.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-45899 (GCVE-0-2022-45899)

Vulnerability from nvd – Published: 2026-05-08 00:00 – Updated: 2026-05-08 13:48

Summary

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 13:47 UTC

CWE

n/a
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mitre mitre root

References

2 references

URL	Tags
https://nokia.com
https://www.exploit-db.com/exploits/51896

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-45899",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T13:47:21.855358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T13:48:07.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/51896"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T04:29:40.863Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://nokia.com"
        },
        {
          "url": "https://www.exploit-db.com/exploits/51896"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-45899",
    "datePublished": "2026-05-08T00:00:00.000Z",
    "dateReserved": "2022-11-26T00:00:00.000Z",
    "dateUpdated": "2026-05-08T13:48:07.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24819 (GCVE-0-2025-24819)

Vulnerability from nvd – Published: 2026-04-07 15:14 – Updated: 2026-04-07 17:56

Title

A Relative Path Traversal vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 17:46 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T17:46:21.365319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-23",
                "description": "CWE-23 Relative Path Traversal",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T17:56:15.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:14:42.719Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24819/"
        }
      ],
      "title": "A Relative Path Traversal vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24819",
    "datePublished": "2026-04-07T15:14:42.719Z",
    "dateReserved": "2025-01-24T13:25:43.870Z",
    "dateUpdated": "2026-04-07T17:56:15.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24818 (GCVE-0-2025-24818)

Vulnerability from nvd – Published: 2026-04-07 15:13 – Updated: 2026-04-07 20:11

Title

An OS Command Injection vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 20:11 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: Earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T20:11:08.674316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T20:11:29.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:13:22.492Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24818/"
        }
      ],
      "title": "An OS Command Injection vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24818",
    "datePublished": "2026-04-07T15:13:22.492Z",
    "dateReserved": "2025-01-24T13:25:43.870Z",
    "dateUpdated": "2026-04-07T20:11:29.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24817 (GCVE-0-2025-24817)

Vulnerability from nvd – Published: 2026-04-07 15:09 – Updated: 2026-04-08 16:15

Title

An OS Command Injection vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-08 15:47 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: Earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T15:47:32.334342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T16:15:12.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:09:47.125Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24817/"
        }
      ],
      "title": "An OS Command Injection vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24817",
    "datePublished": "2026-04-07T15:09:47.125Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-04-08T16:15:12.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-31044 (GCVE-0-2023-31044)

Vulnerability from nvd – Published: 2026-03-03 00:00 – Updated: 2026-03-04 14:40

Summary

An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.

Severity

2 (Low)


                        
                          CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 14:37 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre mitre root

References

2 references

URL	Tags
https://nokia.com
https://www.gruppotim.it/it/footer/red-team/2023/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-31044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T14:37:51.489593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T14:40:29.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:R",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:12:55.882Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://nokia.com"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2023/Motive-Impact-CVE-2023-31044.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-31044",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2023-04-23T00:00:00.000Z",
    "dateUpdated": "2026-03-04T14:40:29.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-35486 (GCVE-0-2021-35486)

Vulnerability from nvd – Published: 2026-03-03 00:00 – Updated: 2026-03-04 15:16

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 15:15 UTC

CWE

n/a
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

mitre mitre root

References

3 references

URL	Tags
https://www.nokia.com/networks/solutions/impact-i…
https://www.nokia.com/notices/responsible-disclosure/
https://www.gruppotim.it/it/footer/red-team/2021/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-35486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T15:15:09.760306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T15:16:03.968Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:18:19.181Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.nokia.com/networks/solutions/impact-iot-platform/"
        },
        {
          "url": "https://www.nokia.com/notices/responsible-disclosure/"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-35486",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2026-03-04T15:16:03.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-35484 (GCVE-0-2021-35484)

Vulnerability from nvd – Published: 2026-03-03 00:00 – Updated: 2026-03-04 15:10

Summary

Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 15:10 UTC

CWE

n/a
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

mitre mitre root

References

3 references

URL	Tags
https://www.nokia.com/networks/solutions/impact-i…
https://www.nokia.com/notices/responsible-disclosure/
https://www.gruppotim.it/it/footer/red-team/2021/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-35484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T15:10:04.557880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-89",
                "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T15:10:45.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:28:34.345Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.nokia.com/networks/solutions/impact-iot-platform/"
        },
        {
          "url": "https://www.nokia.com/notices/responsible-disclosure/"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-35484",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2026-03-04T15:10:45.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-35483 (GCVE-0-2021-35483)

Vulnerability from nvd – Published: 2026-03-03 00:00 – Updated: 2026-03-04 15:55

Summary

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.

Severity

4.1 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 15:54 UTC

CWE

n/a
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

mitre mitre root

References

3 references

URL	Tags
https://www.nokia.com/networks/solutions/impact-i…
https://www.nokia.com/notices/responsible-disclosure/
https://www.gruppotim.it/it/footer/red-team/2021/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-35483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T15:54:26.823779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T15:55:11.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:16:30.116Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.nokia.com/networks/solutions/impact-iot-platform/"
        },
        {
          "url": "https://www.nokia.com/notices/responsible-disclosure/"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-35483",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2026-03-04T15:55:11.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-35485 (GCVE-0-2021-35485)

Vulnerability from nvd – Published: 2026-03-03 00:00 – Updated: 2026-03-04 15:49

Summary

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 15:47 UTC

CWE

n/a
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

mitre mitre root

References

3 references

URL	Tags
https://www.nokia.com/networks/solutions/impact-i…
https://www.nokia.com/notices/responsible-disclosure/
https://www.gruppotim.it/it/footer/red-team/2021/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-35485",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T15:47:36.216760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T15:49:10.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:15:05.398Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.nokia.com/networks/solutions/impact-iot-platform/"
        },
        {
          "url": "https://www.nokia.com/notices/responsible-disclosure/"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35485.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-35485",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2026-03-04T15:49:10.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40465 (GCVE-0-2026-40465)

Vulnerability from cvelistv5 – Published: 2026-08-31 06:37 – Updated: 2026-08-31 15:33

Title

An Open Re-direct Vulnerability in Nokia NSP

Summary

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:32 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	NSP	Affected: 23.11 Affected: 24.4 Affected: 24.8 Affected: 24.11 Affected: 25.4 Affected: 25.8 Affected: 25.11 Unaffected: NSP 24.11-SP15 Unaffected: NSP 25.11-SP5 Unaffected: NSP 26.4 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:32:50.443352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T15:33:24.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NSP",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "23.11"
            },
            {
              "status": "affected",
              "version": "24.4"
            },
            {
              "status": "affected",
              "version": "24.8"
            },
            {
              "status": "affected",
              "version": "24.11"
            },
            {
              "status": "affected",
              "version": "25.4"
            },
            {
              "status": "affected",
              "version": "25.8"
            },
            {
              "status": "affected",
              "version": "25.11"
            },
            {
              "status": "unaffected",
              "version": "NSP 24.11-SP15"
            },
            {
              "status": "unaffected",
              "version": "NSP 25.11-SP5"
            },
            {
              "status": "unaffected",
              "version": "NSP 26.4 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:37:19.360Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/"
        }
      ],
      "title": "An Open Re-direct Vulnerability in Nokia NSP",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40465",
    "datePublished": "2026-08-31T06:37:19.360Z",
    "dateReserved": "2026-04-13T11:28:52.517Z",
    "dateUpdated": "2026-08-31T15:33:24.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40464 (GCVE-0-2026-40464)

Vulnerability from cvelistv5 – Published: 2026-08-31 06:35 – Updated: 2026-08-31 14:33

Title

A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP

Summary

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 14:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	NSP	Affected: 22.3 Affected: 22.6 Affected: 22.9 Affected: 22.11 Affected: 23.4 Affected: 23.8 Affected: 23.11 Affected: 24.4 Affected: 24.8 Affected: 24.11 Affected: 25.4 Affected: 25.8 Affected: 25.11 Unaffected: 24.11-SP15 Unaffected: 25.11-SP5 Unaffected: NSP 26.4 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:33:28.174760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:33:52.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NSP",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "22.3"
            },
            {
              "status": "affected",
              "version": "22.6"
            },
            {
              "status": "affected",
              "version": "22.9"
            },
            {
              "status": "affected",
              "version": "22.11"
            },
            {
              "status": "affected",
              "version": "23.4"
            },
            {
              "status": "affected",
              "version": "23.8"
            },
            {
              "status": "affected",
              "version": "23.11"
            },
            {
              "status": "affected",
              "version": "24.4"
            },
            {
              "status": "affected",
              "version": "24.8"
            },
            {
              "status": "affected",
              "version": "24.11"
            },
            {
              "status": "affected",
              "version": "25.4"
            },
            {
              "status": "affected",
              "version": "25.8"
            },
            {
              "status": "affected",
              "version": "25.11"
            },
            {
              "status": "unaffected",
              "version": "24.11-SP15"
            },
            {
              "status": "unaffected",
              "version": "25.11-SP5"
            },
            {
              "status": "unaffected",
              "version": "NSP 26.4 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:35:32.425Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40464/"
        }
      ],
      "title": "A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40464",
    "datePublished": "2026-08-31T06:35:32.425Z",
    "dateReserved": "2026-04-13T11:28:52.516Z",
    "dateUpdated": "2026-08-31T14:33:52.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40463 (GCVE-0-2026-40463)

Vulnerability from cvelistv5 – Published: 2026-08-31 06:32 – Updated: 2026-08-31 15:36

Title

An Insufficient Role-based Access Control Vulnerability in WaveSuite

Summary

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:36 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	WaveSuite	Affected: 25.6 Affected: 24.12 Affected: 24.6 Affected: 23.6 Unaffected: 25.12FP1 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-40463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:36:13.476760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T15:36:24.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WaveSuite",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "25.6"
            },
            {
              "status": "affected",
              "version": "24.12"
            },
            {
              "status": "affected",
              "version": "24.6"
            },
            {
              "status": "affected",
              "version": "23.6"
            },
            {
              "status": "unaffected",
              "version": "25.12FP1 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T06:32:25.491Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40463/"
        }
      ],
      "title": "An Insufficient Role-based Access Control Vulnerability in WaveSuite",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2026-40463",
    "datePublished": "2026-08-31T06:32:25.491Z",
    "dateReserved": "2026-04-13T11:28:52.516Z",
    "dateUpdated": "2026-08-31T15:36:24.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7406 (GCVE-0-2025-7406)

Vulnerability from cvelistv5 – Published: 2026-06-30 08:59 – Updated: 2026-06-30 13:31

Title

A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:31 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <NM 25R1-NM Unaffected: ≥NM 25R1-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7406",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:31:19.958711Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:31:51.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003cNM 25R1-NM"
            },
            {
              "status": "unaffected",
              "version": "\u2265NM 25R1-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T08:59:58.941Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-7406/"
        }
      ],
      "title": "A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-7406",
    "datePublished": "2026-06-30T08:59:58.941Z",
    "dateReserved": "2025-07-10T06:10:12.822Z",
    "dateUpdated": "2026-06-30T13:31:51.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24816 (GCVE-0-2025-24816)

Vulnerability from cvelistv5 – Published: 2026-06-30 08:58 – Updated: 2026-06-30 13:30

Title

An Improper Access Control vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:30 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <25R2-NM Unaffected: ≥25R2-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:30:08.532062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:30:45.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T11:40:27.463Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24816/"
        }
      ],
      "title": "An Improper Access Control vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24816",
    "datePublished": "2026-06-30T08:58:29.484Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-06-30T13:30:45.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24815 (GCVE-0-2025-24815)

Vulnerability from cvelistv5 – Published: 2026-06-30 08:55 – Updated: 2026-06-30 13:29

Title

An unrestricted file upload vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:28 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: <25R2-NM Unaffected: ≥25R2-NM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:28:43.371983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:29:34.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c25R2-NM"
            },
            {
              "status": "unaffected",
              "version": "\u226525R2-NM"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T11:40:20.157Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24815/"
        }
      ],
      "title": "An unrestricted file upload vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24815",
    "datePublished": "2026-06-30T08:55:42.078Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-06-30T13:29:34.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-9912 (GCVE-0-2025-9912)

Vulnerability from cvelistv5 – Published: 2026-06-16 05:58 – Updated: 2026-06-16 12:28

Title

A local privilege escalation vulnerability in Nokia SR Linux

Summary

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 12:28 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

2 products

Vendor	Product	Version
Nokia	Nokia SR Linux	Affected: < 23.10.8 Affected: < 24.10.6 Affected: < 25.7.2
Nokia	Nokia SR Linux	Unaffected: 23.10.8 Unaffected: 24.10.6 Unaffected: 25.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-9912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T12:28:34.738391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T12:28:56.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Nokia SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 23.10.8"
            },
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            },
            {
              "status": "affected",
              "version": "\u003c 25.7.2"
            }
          ]
        },
        {
          "product": "Nokia SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.10.8"
            },
            {
              "status": "unaffected",
              "version": "24.10.6"
            },
            {
              "status": "unaffected",
              "version": "25.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T05:58:02.543Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-9912/"
        }
      ],
      "title": "A local privilege escalation vulnerability in Nokia SR Linux",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-9912",
    "datePublished": "2026-06-16T05:58:02.543Z",
    "dateReserved": "2025-09-03T08:58:21.602Z",
    "dateUpdated": "2026-06-16T12:28:56.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-10262 (GCVE-0-2025-10262)

Vulnerability from cvelistv5 – Published: 2026-06-16 05:40 – Updated: 2026-06-16 12:32

Title

An unsanitized format validation vulnerability in Nokia SR Linux

Summary

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 12:31 UTC

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

2 products

Vendor	Product	Version
Nokia	SR Linux	Affected: < 23.10.8 Affected: < 24.10.6 Affected: < 25.7.2
Nokia	SR Linux	Unaffected: 23.10.8 Unaffected: 24.10.6 Unaffected: 25.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-10262",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T12:31:09.043017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-134",
                "description": "CWE-134 Use of Externally-Controlled Format String",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T12:32:54.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 23.10.8"
            },
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            },
            {
              "status": "affected",
              "version": "\u003c 25.7.2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SR Linux",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.10.8"
            },
            {
              "status": "unaffected",
              "version": "24.10.6"
            },
            {
              "status": "unaffected",
              "version": "25.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T05:58:15.720Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "name": "Nokia Product Security Advisory",
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-10262/"
        }
      ],
      "title": "An unsanitized format validation vulnerability in Nokia SR Linux",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-10262",
    "datePublished": "2026-06-16T05:40:23.769Z",
    "dateReserved": "2025-09-11T08:45:07.544Z",
    "dateUpdated": "2026-06-16T12:32:54.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-45899 (GCVE-0-2022-45899)

Vulnerability from cvelistv5 – Published: 2026-05-08 00:00 – Updated: 2026-05-08 13:48

Summary

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 13:47 UTC

CWE

n/a
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mitre mitre root

References

2 references

URL	Tags
https://nokia.com
https://www.exploit-db.com/exploits/51896

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-45899",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T13:47:21.855358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T13:48:07.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/51896"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T04:29:40.863Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://nokia.com"
        },
        {
          "url": "https://www.exploit-db.com/exploits/51896"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-45899",
    "datePublished": "2026-05-08T00:00:00.000Z",
    "dateReserved": "2022-11-26T00:00:00.000Z",
    "dateUpdated": "2026-05-08T13:48:07.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24819 (GCVE-0-2025-24819)

Vulnerability from cvelistv5 – Published: 2026-04-07 15:14 – Updated: 2026-04-07 17:56

Title

A Relative Path Traversal vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 17:46 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T17:46:21.365319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-23",
                "description": "CWE-23 Relative Path Traversal",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T17:56:15.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:14:42.719Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24819/"
        }
      ],
      "title": "A Relative Path Traversal vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24819",
    "datePublished": "2026-04-07T15:14:42.719Z",
    "dateReserved": "2025-01-24T13:25:43.870Z",
    "dateUpdated": "2026-04-07T17:56:15.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24818 (GCVE-0-2025-24818)

Vulnerability from cvelistv5 – Published: 2026-04-07 15:13 – Updated: 2026-04-07 20:11

Title

An OS Command Injection vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 20:11 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: Earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T20:11:08.674316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T20:11:29.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:13:22.492Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24818/"
        }
      ],
      "title": "An OS Command Injection vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24818",
    "datePublished": "2026-04-07T15:13:22.492Z",
    "dateReserved": "2025-01-24T13:25:43.870Z",
    "dateUpdated": "2026-04-07T20:11:29.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24817 (GCVE-0-2025-24817)

Vulnerability from cvelistv5 – Published: 2026-04-07 15:09 – Updated: 2026-04-08 16:15

Title

An OS Command Injection vulnerability in Nokia MantaRay NM

Summary

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-08 15:47 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Nokia mitre root

References

1 reference

URL	Tags
https://www.nokia.com/we-are-nokia/security/produ…

Impacted products

1 product

Vendor	Product	Version
Nokia	MantaRay NM	Affected: Earlier than 25R1-NM (exclusive)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T15:47:32.334342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T16:15:12.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MantaRay NM",
          "vendor": "Nokia",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than 25R1-NM (exclusive)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:09:47.125Z",
        "orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
        "shortName": "Nokia"
      },
      "references": [
        {
          "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24817/"
        }
      ],
      "title": "An OS Command Injection vulnerability in Nokia MantaRay NM",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
    "assignerShortName": "Nokia",
    "cveId": "CVE-2025-24817",
    "datePublished": "2026-04-07T15:09:47.125Z",
    "dateReserved": "2025-01-24T13:25:43.869Z",
    "dateUpdated": "2026-04-08T16:15:12.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-31044 (GCVE-0-2023-31044)

Vulnerability from cvelistv5 – Published: 2026-03-03 00:00 – Updated: 2026-03-04 14:40

Summary

An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.

Severity

2 (Low)


                        
                          CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:R

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 14:37 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre mitre root

References

2 references

URL	Tags
https://nokia.com
https://www.gruppotim.it/it/footer/red-team/2023/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-31044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T14:37:51.489593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T14:40:29.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:R",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T17:12:55.882Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://nokia.com"
        },
        {
          "url": "https://www.gruppotim.it/it/footer/red-team/2023/Motive-Impact-CVE-2023-31044.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-31044",
    "datePublished": "2026-03-03T00:00:00.000Z",
    "dateReserved": "2023-04-23T00:00:00.000Z",
    "dateUpdated": "2026-03-04T14:40:29.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

294 vulnerabilities by nokia

CVE-2026-40465 (GCVE-0-2026-40465)

CVE-2026-40464 (GCVE-0-2026-40464)

CVE-2026-40463 (GCVE-0-2026-40463)

CVE-2025-7406 (GCVE-0-2025-7406)

CVE-2025-24816 (GCVE-0-2025-24816)

CVE-2025-24815 (GCVE-0-2025-24815)

CVE-2025-9912 (GCVE-0-2025-9912)

CVE-2025-10262 (GCVE-0-2025-10262)

CVE-2022-45899 (GCVE-0-2022-45899)

CVE-2025-24819 (GCVE-0-2025-24819)

CVE-2025-24818 (GCVE-0-2025-24818)

CVE-2025-24817 (GCVE-0-2025-24817)

CVE-2023-31044 (GCVE-0-2023-31044)

CVE-2021-35486 (GCVE-0-2021-35486)

CVE-2021-35484 (GCVE-0-2021-35484)

CVE-2021-35483 (GCVE-0-2021-35483)

CVE-2021-35485 (GCVE-0-2021-35485)

CVE-2026-40465 (GCVE-0-2026-40465)

CVE-2026-40464 (GCVE-0-2026-40464)

CVE-2026-40463 (GCVE-0-2026-40463)

CVE-2025-7406 (GCVE-0-2025-7406)

CVE-2025-24816 (GCVE-0-2025-24816)

CVE-2025-24815 (GCVE-0-2025-24815)

CVE-2025-9912 (GCVE-0-2025-9912)

CVE-2025-10262 (GCVE-0-2025-10262)

CVE-2022-45899 (GCVE-0-2022-45899)

CVE-2025-24819 (GCVE-0-2025-24819)

CVE-2025-24818 (GCVE-0-2025-24818)

CVE-2025-24817 (GCVE-0-2025-24817)

CVE-2023-31044 (GCVE-0-2023-31044)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

294 vulnerabilities by nokia

CVE-2026-40465 (GCVE-0-2026-40465)

CVE-2026-40464 (GCVE-0-2026-40464)

CVE-2026-40463 (GCVE-0-2026-40463)

CVE-2025-7406 (GCVE-0-2025-7406)

CVE-2025-24816 (GCVE-0-2025-24816)

CVE-2025-24815 (GCVE-0-2025-24815)

CVE-2025-9912 (GCVE-0-2025-9912)

CVE-2025-10262 (GCVE-0-2025-10262)

CVE-2022-45899 (GCVE-0-2022-45899)

CVE-2025-24819 (GCVE-0-2025-24819)

CVE-2025-24818 (GCVE-0-2025-24818)

CVE-2025-24817 (GCVE-0-2025-24817)

CVE-2023-31044 (GCVE-0-2023-31044)

CVE-2021-35486 (GCVE-0-2021-35486)

CVE-2021-35484 (GCVE-0-2021-35484)

CVE-2021-35483 (GCVE-0-2021-35483)

CVE-2021-35485 (GCVE-0-2021-35485)

CVE-2026-40465 (GCVE-0-2026-40465)

CVE-2026-40464 (GCVE-0-2026-40464)

CVE-2026-40463 (GCVE-0-2026-40463)

CVE-2025-7406 (GCVE-0-2025-7406)

CVE-2025-24816 (GCVE-0-2025-24816)

CVE-2025-24815 (GCVE-0-2025-24815)

CVE-2025-9912 (GCVE-0-2025-9912)

CVE-2025-10262 (GCVE-0-2025-10262)

CVE-2022-45899 (GCVE-0-2022-45899)

CVE-2025-24819 (GCVE-0-2025-24819)

CVE-2025-24818 (GCVE-0-2025-24818)

CVE-2025-24817 (GCVE-0-2025-24817)

CVE-2023-31044 (GCVE-0-2023-31044)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.