Read the docs
TI-2025-06747 Aliases CVE-2025-7406GHSA-5xvf-r542-vqqf

A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM

Priority LOW 35CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00137 3rd percentileScored 2026-11-07
Fix Fixed MantaRay NM (Nokia): ≥NM 25R1-NM

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NokiaMantaRay NM<NM 25R1-NM≥NM 25R1-NMPatch availableCNA
  • MantaRay NM VendorNokia Affected <NM 25R1-NM Fixed in ≥NM 25R1-NM Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*before 25R2-NMVulnerableNokia
  • cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:* Versions before 25R2-NM Vulnerable ·Nokia

Remediation

  • Fix · CNA MantaRay NM (Nokia) Fixed in ≥NM 25R1-NM

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7406
  2. 2026-10-03 Alias added: GHSA-5xvf-r542-vqqf

References

Advisory 1

  • TI-2025-18534 An OS Command Injection vulnerability in Nokia MantaRay NM CVSS 3.1HIGH 8.0
  • TI-2025-18533 An OS Command Injection vulnerability in Nokia MantaRay NM CVSS 3.1HIGH 8.0
  • TI-2025-18531 An unrestricted file upload vulnerability in Nokia MantaRay NM CVSS 3.1HIGH 7.8
  • TI-2025-18532 An Improper Access Control vulnerability in Nokia MantaRay NM CVSS 3.1MEDIUM 6.5
  • TI-2025-18535 A Relative Path Traversal vulnerability in Nokia MantaRay NM CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences