PT-2025-27609 · Unknown · Nokia Single Ran Baseband Oam Service

Guillaume Teissier + 3 · Publicado 2025-07-02 · Atualizado 2025-07-02 · CVE-2025-24331

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Single RAN baseband OAM service versions prior to 24R1-SR 0.2 MP

Description: The Single RAN baseband OAM service is intended to run as an unprivileged service but initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive and could potentially allow actions beyond the intended scope of the OAM service, including gaining root privileges, accessing root-owned files, modifying them, and then returning them to root ownership.

Recommendations: For versions prior to 24R1-SR 0.2 MP, update to release 24R1-SR 0.2 MP or later to restrict the OAM service software capabilities to the minimum necessary.

Correção

Enumeração de Fraquezas

CWE-250

Identificadores relacionados

BDU:2025-07974

CVE-2025-24331

Produtos afetados

Nokia Single Ran Baseband Oam Service

Referências · 5

• https://t.me/cvenotify/127363 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-07974 · Nota de Segurança
• https://twitter.com/CVEnew/status/1940339416779706498 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-24331 · Nota de Segurança
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24331 · Nota