CVE-2025-24333: nokia nokia single ran Command Injection

Vulnerability summary

CVE-2025-24333 is a medium (CVSS 6.4) Command Injection vulnerability in nokia nokia single ran. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities.

Timeline

1. 02-07-2025
   PublishedVulnerability first disclosed.
2. 02-07-2025
   Last modifiedVulnerability information updated.

Description

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-SR 1.0 MP and later, by adding proper input validation to OAM service process which prevents injecting special characters via baseband internal COMA_config.xml file.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.