TI-2025-18076 Aliases CVE-2025-24332 GHSA-8vqg-92mx-5p5h

Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication

LOW 33CWE-288Published 2025-07-02 · Updated 2025-07-02

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-288.

Summary

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0021 11th percentileScored 2026-11-07

Fix Fixed Nokia Single RAN AirScale (Flexi Multiradio is not affected) (Nokia): 23R4-SR 3.0 MP and later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Nokia	Nokia Single RAN AirScale (Flexi Multiradio is not affected)	All the releases prior to 23R4-SR 3.0 MP	23R4-SR 3.0 MP and later	Patch available	CNA

Nokia Single RAN AirScale (Flexi Multiradio is not affected) VendorNokia Affected All the releases prior to 23R4-SR 3.0 MP Fixed in 23R4-SR 3.0 MP and later Patch available CNA

Remediation

Fix · CNA Nokia Single RAN AirScale (Flexi Multiradio is not affected) (Nokia) Fixed in 23R4-SR 3.0 MP and later

Timeline

2026-10-02 Threatist record created from CVE-2025-24332
2026-10-03 Alias added: GHSA-8vqg-92mx-5p5h

References

Other 1

Nokia Security Advisory

TI-2022-12519 /SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. CVSS 3.1HIGH 8.8
TI-2022-11485 An issue was discovered in Nokia NetAct 22 through the Administration of Measurements… CVSS 3.1HIGH 8.8
TI-2022-11484 An issue was discovered in Nokia NetAct 22. CVSS 3.1HIGH 8.8
TI-2023-21971 Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling… CVSS 3.1HIGH 7.5
TI-2022-16599 Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default… CVSS 3.1HIGH 8.4
TI-2022-22690 Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote… CVSS 3.1MEDIUM 6.5

See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences