https://vulnogram.org/ Most recent CVEs assigned by Nokia (nokia). https://vulnogram.org/seaview/icons/nokia.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-34485 https://vulnogram.org/CVE-2026-34485 Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. Thi… Tue, 20 Oct 2026 12:13:17 GMT https://vulnogram.org/CVE-2026-34484 https://vulnogram.org/CVE-2026-34484 Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local s… Tue, 20 Oct 2026 12:10:44 GMT https://vulnogram.org/CVE-2026-40465 https://vulnogram.org/CVE-2026-40465 NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. Medium Network Exploitable Mon, 31 Aug 2026 06:37:19 GMT https://vulnogram.org/CVE-2026-40464 https://vulnogram.org/CVE-2026-40464 NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user vi… Medium Mon, 31 Aug 2026 06:35:32 GMT https://vulnogram.org/CVE-2026-40463 https://vulnogram.org/CVE-2026-40463 WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the cor… High Mon, 31 Aug 2026 06:32:25 GMT https://vulnogram.org/CVE-2025-7406 https://vulnogram.org/CVE-2025-7406 Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level acc… High Tue, 30 Jun 2026 08:59:58 GMT https://vulnogram.org/CVE-2025-24816 https://vulnogram.org/CVE-2025-24816 Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privilege… Medium Tue, 30 Jun 2026 08:58:29 GMT https://vulnogram.org/CVE-2025-24815 https://vulnogram.org/CVE-2025-24815 Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system. High Tue, 30 Jun 2026 08:55:42 GMT https://vulnogram.org/CVE-2025-9912 https://vulnogram.org/CVE-2025-9912 Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege. Medium Tue, 16 Jun 2026 05:58:02 GMT https://vulnogram.org/CVE-2025-10262 https://vulnogram.org/CVE-2025-10262 Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges. Medium Tue, 16 Jun 2026 05:40:23 GMT https://vulnogram.org/CVE-2025-24819 https://vulnogram.org/CVE-2025-24819 Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application. Medium Tue, 07 Apr 2026 15:14:42 GMT https://vulnogram.org/CVE-2025-24818 https://vulnogram.org/CVE-2025-24818 Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application. High Tue, 07 Apr 2026 15:13:22 GMT https://vulnogram.org/CVE-2025-24817 https://vulnogram.org/CVE-2025-24817 Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application. High Tue, 07 Apr 2026 15:09:47 GMT https://vulnogram.org/CVE-2025-10258 https://vulnogram.org/CVE-2025-10258 Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive information. Medium Thu, 05 Feb 2026 07:13:50 GMT https://vulnogram.org/CVE-2025-9974 https://vulnogram.org/CVE-2025-9974 The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authen… High Mon, 02 Feb 2026 09:01:31 GMT https://vulnogram.org/CVE-2025-0980 https://vulnogram.org/CVE-2025-0980 Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials. Medium Wed, 07 Jan 2026 07:24:46 GMT https://vulnogram.org/CVE-2023-49565 https://vulnogram.org/CVE-2023-49565 The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized wit… High Thu, 18 Sep 2025 06:11:53 GMT https://vulnogram.org/CVE-2023-49564 https://vulnogram.org/CVE-2023-49564 The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoin… High Thu, 18 Sep 2025 06:10:27 GMT https://vulnogram.org/CVE-2025-24938 https://vulnogram.org/CVE-2025-24938 The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) to the application has the potential execute commands on the operating system u… High Mon, 21 Jul 2025 06:33:56 GMT https://vulnogram.org/CVE-2025-24937 https://vulnogram.org/CVE-2025-24937 File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bou… Critical Mon, 21 Jul 2025 06:31:24 GMT https://vulnogram.org/CVE-2025-24936 https://vulnogram.org/CVE-2025-24936 The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Interne… Critical Mon, 21 Jul 2025 06:27:46 GMT https://vulnogram.org/CVE-2025-24335 https://vulnogram.org/CVE-2025-24335 Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical explo… Low Wed, 02 Jul 2025 08:35:46 GMT https://vulnogram.org/CVE-2025-24334 https://vulnogram.org/CVE-2025-24334 The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network. Low Wed, 02 Jul 2025 08:34:12 GMT https://vulnogram.org/CVE-2025-24333 https://vulnogram.org/CVE-2025-24333 Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service… Medium Wed, 02 Jul 2025 08:32:57 GMT https://vulnogram.org/CVE-2025-24332 https://vulnogram.org/CVE-2025-24332 Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseb… High Wed, 02 Jul 2025 08:31:38 GMT https://vulnogram.org/CVE-2025-24331 https://vulnogram.org/CVE-2025-24331 The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root pe… Medium Wed, 02 Jul 2025 08:30:19 GMT https://vulnogram.org/CVE-2025-24330 https://vulnogram.org/CVE-2025-24330 Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earli… Medium Wed, 02 Jul 2025 08:29:03 GMT https://vulnogram.org/CVE-2025-24329 https://vulnogram.org/CVE-2025-24329 Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earl… Medium Wed, 02 Jul 2025 08:27:43 GMT https://vulnogram.org/CVE-2025-24328 https://vulnogram.org/CVE-2025-24328 Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than relea… Medium Wed, 02 Jul 2025 07:39:30 GMT https://vulnogram.org/CVE-2023-6729 https://vulnogram.org/CVE-2023-6729 Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file… High Thu, 17 Oct 2024 12:19:19 GMT https://vulnogram.org/CVE-2023-6728 https://vulnogram.org/CVE-2023-6728 Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content. Low Thu, 17 Oct 2024 12:16:02 GMT