CVE-2025-24333

MEDIUM

Nokia Single RAN <24R1-SR 1.0 MP - Command Injection

Title source: llm

Description

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-SR 1.0 MP and later, by adding proper input validation to OAM service process which prevents injecting special characters via baseband internal COMA_config.xml file.

References (1)

Core 1

Core References

Various Sources

https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24333/

Scores

CVSS v3 6.4

EPSS 0.0016

EPSS Percentile 5.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (2)

Nokia/Nokia Single RAN 24R1-SR 1.0 MP and later

Nokia/Nokia Single RAN All the releases prior to 24R1-SR 1.0 MP

Published Jul 02, 2025

Tracked Since Feb 18, 2026