PT-2026-22761

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283 Description A Cross-Site Request Forgery CSRF issue exists in Nokia IMPACT. This allows a remote attacker to import and overwrite the entire application configuration. The issue is due...

CVE-2021-35486

CVE-2021-35486 affects Nokia IMPACT up to version 19.11.2.10-20210118042150283. The issue is a CSRF vulnerability in the /ui/rest-proxy/entity/import endpoint where neither the X-CSRF-NONCE header nor the CSRF-NONCE cookie is validated, allowing a remote attacker to import and overwrite the entir...

CVE-2021-35485

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the...

CVE-2021-35483

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an...

CVE-2025-9974 Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitra...

CVE-2025-9974 Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitra...

CVE-2025-9974

The CVE-2025-9974 entry concerns the unified WEBUI of Nokia ONT/Beacon devices. The issue is an input handling flaw in the WEBUI that, due to insufficient validation of user-supplied data, allows authenticated users with low privileges to trigger system-level command execution on the underlying O...

Nokia ONT 安全漏洞

Nokia ONT is a fiber-optic network terminal device developed by Finnish company Nokia. Nokia ONT has a security vulnerability, which stems from defects in its unified WEBUI application programming. This vulnerability may allow low-privilege users who are authenticated to execute arbitrary...

CVE-2023-25185

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating syst...

CVE-2021-41487

NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...

CVE-2025-0980

Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials...

CVE-2011-0498

Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long entry in a playlist .npl file...

CVE-2023-25186

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP as a BTS administrator removes security hardenings from a Nokia Single RAN BTS baseband unit, a directory path traversal in the Nokia BTS baseband unit diagnostic tool AaShell which is by default disabled...

CVE-2023-25187

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change factory-time installed default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server disable...

CVE-2025-0980

Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials...

CVE-2025-0980

Nokia SR Linux contains an authentication bypass in its JSON-RPC service. The vulnerability arises from invalid validation that allows access to JSON-RPC without valid credentials, enabling unauthorized access locally. Affected product: Nokia SR Linux (JSON-RPC interface); underlying issue: flawe...

CVE-2025-0980 JSON RPC authentication bypass in Nokia SR Linux

Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials...

CVE-2025-0980 JSON RPC authentication bypass in Nokia SR Linux

Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials...

Nokia SR Linux 安全漏洞

Nokia SR Linux is a network operating system from the Finnish company Nokia. A security vulnerability exists in Nokia SR Linux that originates from improper authentication and could lead to unauthorized access to JSON-RPC services...

PT-2026-1577

Name of the Vulnerable Software and Affected Versions Nokia SR Linux affected versions not specified Description An authentication issue exists in Nokia SR Linux that permits unauthorized access to the JSON-RPC service. A flawed validation process allows access to the service without requiring...