XML External Entity Attack in Nokia NetAct Configuration Dashboard

CVE-2023-26057

Summary

An XML External Entity (XXE) vulnerability has been identified in Nokia's NetAct product prior to version 22 FP2211. This issue arises due to inadequate input validation and improper configuration of the XML parser on the Configuration Dashboard page. Although the exploitation of this vulnerability is notably challenging for external attackers—who would need to navigate dynamically generated parameters such as Jsession-id, CSRF token, and Nxsrf token—internal users may have a plausible attack vector, making it critical for organizations to secure internal access.

References