PT-2026-22760 · Nokia · Nokia Impact

Publicado 2026-03-03 · Atualizado 2026-03-03 · CVE-2021-35485

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description The Applications component of Nokia IMPACT allows an authenticated user to upload server-side executable files. This occurs via the /ui/rest-proxy/application fileupload parameter when adding a new application or editing an existing one. The fileupload parameter is the point of exploitation.

Recommendations Update Nokia IMPACT to a version later than 19.11.2.10-20210118042150283.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-35485

Produtos afetados

Nokia Impact

Referências · 8

• https://twitter.com/infoflowcloud/status/2028902188420870638 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028900647953715284 · Publicação no Twitter
• https://t.me/CVEtracker/46226 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-35485 · Nota de Segurança
• https://nokia.com/networks/solutions/impact-iot-platform · Nota
• https://osv.dev/vulnerability/CVE-2021-35485 · Aviso do Fabricante
• https://nokia.com/notices/responsible-disclosure · Nota
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35485.html · Aviso do Fabricante