CVE-2022-45899: nokia broadcast_message_center OS Command Injection
CVSS: 6.5v3.1MediumAnalyzed
Published 08-05-2026Last modified 08-05-2026
Vulnerability summary
CVE-2022-45899 is a medium (CVSS 6.5) OS Command Injection vulnerability in nokia broadcast_message_center. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
1.36%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 08-05-2026Last modifiedVulnerability information updated.
Description
Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.
CVSS metrics
2 scores · 2 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSourcesAll 2 agree
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.36% on 19-09-2026
19-09-202619-10-2026
EPSS score1.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNokia BMC Log Scanner - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Nokia1 product
- broadcast_message_center< 13.1
1 vendor · 1 product
References
2 links- nokia.comNot Applicable