TI-2023-10649 Aliases CVE-2023-25188 GHSA-2gpj-wh36-7xwf

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.

LOW 33CWE-346Published 2023-06-16 · Updated 2024-12-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-346 and CWE-269.

Summary

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia Single RAN BTS baseband unit, the BTS baseband unit diagnostic tool AaShell (which is by default disabled) allows unauthenticated access from the mobile network solution internal BTS management network to the BTS embedded Linux operating-system level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00105 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:nokia:asika_airscale_firmware:19b:::::::*	19b	Vulnerable	Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20a:::::::*	20a	Vulnerable	Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20b:::::::*	20b	Vulnerable	Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20c:::::::*	20c	Vulnerable	Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:21a:::::::*	21a	Vulnerable	Nokia
cpe:2.3:h:nokia:asika_airscale:-:::::::*	not specified by NVD	Running on	Nokia

cpe:2.3:o:nokia:asika_airscale_firmware:19b:*:*:*:*:*:*:* Versions 19b Vulnerable ·Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20a:*:*:*:*:*:*:* Versions 20a Vulnerable ·Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20b:*:*:*:*:*:*:* Versions 20b Vulnerable ·Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:20c:*:*:*:*:*:*:* Versions 20c Vulnerable ·Nokia
cpe:2.3:o:nokia:asika_airscale_firmware:21a:*:*:*:*:*:*:* Versions 21a Vulnerable ·Nokia
cpe:2.3:h:nokia:asika_airscale:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Nokia

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-25188
2026-10-03 Alias added: GHSA-2gpj-wh36-7xwf

References

Advisory 1

https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25188/

Other 1

https://Nokia.com

TI-2023-10648 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1HIGH 7.0
TI-2023-10646 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1HIGH 7.8
TI-2023-10647 An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. CVSS 3.1MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences