PT-2025-27606 · Nokia · Nokia Single Ran Baseband Oam Service

Guillaume Teissier + 3 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-24328

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:A/AC:H/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband OAM service component versions prior to 24R1-SR 1.0 MP

Description: The issue occurs when a crafted SOAP "set" operation message is sent within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network, causing the Nokia Single RAN baseband OAM service component to restart. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.

Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP "set" operation message within the MNO internal RAN management network to minimize the risk of exploitation.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2025-07971

CVE-2025-24328

Affected Products

Nokia Single Ran Baseband Oam Service

References · 7

• https://bdu.fstec.ru/vul/2025-07971 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24328 · Security Note
• https://twitter.com/VulmonFeeds/status/1940330145941725439 · Twitter Post
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24328 · Note
• https://t.me/cvenotify/127357 · Telegram Post
• https://twitter.com/CVEnew/status/1940325022221865223 · Twitter Post
• https://twitter.com/ZeroDayCVE/status/1940335677079777359 · Twitter Post