PT-2023-19967 · Nokia · Nokia Airscale Asika Single Ran+1

Geoffrey Bertoli + 1 · Publicado 2023-06-16 · Atualizado 2023-07-05 · CVE-2023-25186

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Média

Vetor base

AC:H/AV:L/A:H/C:L/I:L/PR:H/S:U/UI:R

Name of the Vulnerable Software and Affected Versions NOKIA Airscale ASIKA Single RAN devices versions prior to 21B

Description An issue was discovered in the Nokia BTS baseband unit diagnostic tool AaShell, which is disabled by default. If security hardenings are removed from a Nokia Single RAN BTS baseband unit by a CSP administrator, a directory path traversal provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network.

Recommendations For versions prior to 21B, consider disabling the AaShell diagnostic tool until a patch is available to prevent potential exploitation. Restrict access to the BTS baseband unit internal filesystem to minimize the risk of unauthorized access. Ensure that security hardenings are not removed from the Nokia Single RAN BTS baseband unit to prevent this issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-25186

Produtos afetados

Aashell

Nokia Airscale Asika Single Ran

Referências · 5

• https://t.me/cvenotify/52535 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25186 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25186 · Nota de Segurança
• https://nokia.com · Nota
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25186 · Aviso do Fabricante