PT-2025-27609 · Unknown · Nokia Single Ran Baseband Oam Service

Guillaume Teissier + 3 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-24331

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Single RAN baseband OAM service versions prior to 24R1-SR 0.2 MP

Description: The Single RAN baseband OAM service is intended to run as an unprivileged service but initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive and could potentially allow actions beyond the intended scope of the OAM service, including gaining root privileges, accessing root-owned files, modifying them, and then returning them to root ownership.

Recommendations: For versions prior to 24R1-SR 0.2 MP, update to release 24R1-SR 0.2 MP or later to restrict the OAM service software capabilities to the minimum necessary.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2025-07974

CVE-2025-24331

Affected Products

Nokia Single Ran Baseband Oam Service

References · 5

• https://bdu.fstec.ru/vul/2025-07974 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24331 · Security Note
• https://t.me/cvenotify/127363 · Telegram Post
• https://twitter.com/CVEnew/status/1940339416779706498 · Twitter Post
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24331 · Note