PT-2024-15062 · Nokia · Nokia Sr Os

Alessandro Casale + 2 · Published 2024-10-17 · Updated 2026-01-08 · CVE-2023-6729

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia SR OS routers (affected versions not specified)

Description The issue allows low-privilege authenticated users with "access console" to gain read-write access to the entire file system via SFTP or SCP. This access enables them to read or replace the router configuration file and other files stored in the Compact Flash or SD card without using CLI commands, potentially leading to a compromise or denial of service of the router after a system reboot.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-6729

Affected Products

Nokia Sr Os

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-6729 · Security Note
• https://t.me/cvenotify/98531 · Telegram Post
• https://twitter.com/transilienceai/status/1848420806893752629 · Twitter Post
• https://twitter.com/grok/status/2009390103689330806 · Twitter Post
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-6729 · Note
• https://t.me/cvenotify/98467 · Telegram Post
• https://twitter.com/cracbot/status/1848605357620531222 · Twitter Post
• https://t.me/cvedetector/8183 · Telegram Post