TI-2025-18075 Aliases CVE-2025-24331 GHSA-h7fw-h8wx-7pqq

Nokia Single RAN baseband OAM service extensive capabilities

LOW 29CWE-250Published 2025-07-02 · Updated 2025-07-02

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-250.

Summary

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. These actions could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returning them to root ownership. This issue has been corrected starting from release 24R1-SR 0.2 MP and later. Beginning with release 24R1-SR 0.2 MP, the OAM service software capabilities are restricted to the minimum necessary.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00152 4th percentileScored 2026-11-07

Fix Fixed Nokia Single RAN (Nokia): 24R1-SR 0.2 MP and later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Nokia	Nokia Single RAN	All the releases prior to 24R1-SR 0.2 MP	24R1-SR 0.2 MP and later	Patch available	CNA

Nokia Single RAN VendorNokia Affected All the releases prior to 24R1-SR 0.2 MP Fixed in 24R1-SR 0.2 MP and later Patch available CNA

Remediation

Fix · CNA Nokia Single RAN (Nokia) Fixed in 24R1-SR 0.2 MP and later

Timeline

2026-10-02 Threatist record created from CVE-2025-24331
2026-10-03 Alias added: GHSA-h7fw-h8wx-7pqq

References

Other 1

Nokia Security Advisory

TI-2022-12519 /SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. CVSS 3.1HIGH 8.8
TI-2022-11485 An issue was discovered in Nokia NetAct 22 through the Administration of Measurements… CVSS 3.1HIGH 8.8
TI-2022-11484 An issue was discovered in Nokia NetAct 22. CVSS 3.1HIGH 8.8
TI-2023-21971 Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling… CVSS 3.1HIGH 7.5
TI-2022-16599 Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default… CVSS 3.1HIGH 8.4
TI-2022-22690 Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote… CVSS 3.1MEDIUM 6.5

See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences