PT-2026-22760 · Nokia · Nokia Impact

Published 2026-03-03 · Updated 2026-03-03 · CVE-2021-35485

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description The Applications component of Nokia IMPACT allows an authenticated user to upload server-side executable files. This occurs via the /ui/rest-proxy/application fileupload parameter when adding a new application or editing an existing one. The fileupload parameter is the point of exploitation.

Recommendations Update Nokia IMPACT to a version later than 19.11.2.10-20210118042150283.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-35485

Affected Products

Nokia Impact

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-35485 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35485 · Vendor Advisory
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35485.html · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2028902188420870638 · Twitter Post
• https://twitter.com/CVEnew/status/2028900647953715284 · Twitter Post
• https://t.me/CVEtracker/46226 · Telegram Post
• https://nokia.com/networks/solutions/impact-iot-platform · Note
• https://nokia.com/notices/responsible-disclosure · Note