PT-2026-22761 · Nokia · Nokia Impact

Published 2026-03-03 · Updated 2026-03-13 · CVE-2021-35486

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description A Cross-Site Request Forgery (CSRF) issue exists in Nokia IMPACT. This allows a remote attacker to import and overwrite the entire application configuration. The issue is due to a lack of validation for the X-CSRF-NONCE HTTP header and the CSRF-NONCE cookie in the /ui/rest-proxy/entity/import API endpoint.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-35486

Affected Products

Nokia Impact

References · 9

• https://osv.dev/vulnerability/CVE-2021-35486 · Vendor Advisory
• https://nokia.com/notices/responsible-disclosure · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35486 · Security Note
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html · Note
• https://t.me/cveNotify/155377 · Telegram Post
• https://twitter.com/CVEnew/status/2028900648851263754 · Twitter Post
• https://nokia.com/networks/solutions/impact-iot-platform · Note
• https://t.me/CVEtracker/46227 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028902204799594860 · Twitter Post