PT-2023-19969 · Nokia · Aashell+1

Geoffrey Bertoli + 1 · Published 2023-06-16 · Updated 2024-12-12 · CVE-2023-25188

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NOKIA Airscale ASIKA Single RAN devices versions prior to 21B

Description An issue was discovered where if security hardenings are removed from the Nokia Single RAN BTS baseband unit by a CSP as a BTS administrator, the BTS baseband unit diagnostic tool AaShell allows unauthenticated access from the mobile network solution internal BTS management network to the BTS embedded Linux operating-system level. This access is possible because AaShell, which is disabled by default, can be accessed without authentication.

Recommendations For versions prior to 21B, as a temporary workaround, consider disabling the AaShell diagnostic tool until a patch is available. Restrict access to the BTS baseband unit to minimize the risk of exploitation. Ensure that security hardenings are not removed from the Nokia Single RAN BTS baseband unit to prevent unauthenticated access.

Fix

Improper Privilege Management

Origin Validation Error

Weakness Enumeration

CWE-269

CWE-346

Related Identifiers

CVE-2023-25188

Affected Products

Aashell

Nokia Airscale Asika Single Ran

References · 6

• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25188 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25188 · Security Note
• https://t.me/cvenotify/104083 · Telegram Post
• https://nokia.com · Note
• https://t.me/cvenotify/52534 · Telegram Post