PT-2023-19966 · Nokia · Nokia Airscale Asika Single Ran

Geoffrey Bertoli + 1 · Published 2023-06-16 · Updated 2024-12-12 · CVE-2023-25185

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NOKIA Airscale ASIKA Single RAN devices versions prior to 21B

Description An issue was discovered in the Nokia Single RAN software releases, where certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources. This is due to an internal fault in the mobile network solution.

Recommendations For versions prior to 21B, consider restricting access to the BTS embedded operating system (OS) resources to minimize the risk of exploitation. As a temporary workaround, review and adjust the privileges of software processes in the BTS internal software design to ensure they are appropriately limited. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

CVE-2023-25185

Affected Products

Nokia Airscale Asika Single Ran

References · 5

• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25185 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25185 · Vendor Advisory
• https://t.me/cvenotify/52536 · Telegram Post
• https://nokia.com · Note