Read the docs
TI-2023-10648 Aliases CVE-2023-25187GHSA-cmvf-q3f2-554c

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.

Priority HIGH 66CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server (disabled by default) continues to apply the default SSH public/private key values. These keys don't give access to BTS, because service user authentication is username/password-based on top of SSH. Nokia factory installed default SSH keys are meant to be changed from operator-specific values during the BTS deployment commissioning phase. However, before the 21B release, BTS commissioning manuals did not provide instructions to change default SSH keys (to BTS operator-specific values). This leads to a possibility for malicious operations staff (inside a CSP network) to attempt MITM exploitation of BTS service user access, during the moments that SSH is enabled for Nokia service personnel to perform troubleshooting activities.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00956 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:nokia:asika_airscale_firmware:19b:*:*:*:*:*:*:*19bVulnerableNokia
cpe:2.3:o:nokia:asika_airscale_firmware:20a:*:*:*:*:*:*:*20aVulnerableNokia
cpe:2.3:o:nokia:asika_airscale_firmware:20b:*:*:*:*:*:*:*20bVulnerableNokia
cpe:2.3:o:nokia:asika_airscale_firmware:20c:*:*:*:*:*:*:*20cVulnerableNokia
cpe:2.3:o:nokia:asika_airscale_firmware:21a:*:*:*:*:*:*:*21aVulnerableNokia
cpe:2.3:h:nokia:asika_airscale:-:*:*:*:*:*:*:*not specified by NVDRunning onNokia
  • cpe:2.3:o:nokia:asika_airscale_firmware:19b:*:*:*:*:*:*:* Versions 19b Vulnerable ·Nokia
  • cpe:2.3:o:nokia:asika_airscale_firmware:20a:*:*:*:*:*:*:* Versions 20a Vulnerable ·Nokia
  • cpe:2.3:o:nokia:asika_airscale_firmware:20b:*:*:*:*:*:*:* Versions 20b Vulnerable ·Nokia
  • cpe:2.3:o:nokia:asika_airscale_firmware:20c:*:*:*:*:*:*:* Versions 20c Vulnerable ·Nokia
  • cpe:2.3:o:nokia:asika_airscale_firmware:21a:*:*:*:*:*:*:* Versions 21a Vulnerable ·Nokia
  • cpe:2.3:h:nokia:asika_airscale:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Nokia

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25187
  2. 2026-10-03 Alias added: GHSA-cmvf-q3f2-554c

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-10649 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1HIGH 7.8
  • TI-2023-10646 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1HIGH 7.8
  • TI-2023-10647 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences