PT-2025-27608 · Nokia · Nokia Single Ran Baseband

Guillaume Teissier + 3 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-24330

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP

Description: The issue arises when a crafted SOAP "provision" operation message is sent with a malicious PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network, causing a path traversal issue. This has been mitigated in release 24R1-SR 1.0 MP and later by performing PlanId field input validations in the OAM service software.

Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP "provision" operation message endpoint to minimize the risk of exploitation. Avoid using the PlanId field in the affected API endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-07973

CVE-2025-24330

Affected Products

Nokia Single Ran Baseband

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24330 · Security Note
• https://bdu.fstec.ru/vul/2025-07973 · Security Note
• https://twitter.com/CVEnew/status/1940339417853444228 · Twitter Post
• https://t.me/cvenotify/127362 · Telegram Post
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24330 · Note
• https://twitter.com/VulmonFeeds/status/1940360875606417527 · Twitter Post