Path Traversal Vulnerability in Nokia Single RAN Baseband Software
CVE-2025-24329
6.4MEDIUM
What is CVE-2025-24329?
A path traversal vulnerability exists in Nokia's Single RAN baseband software affecting versions prior to 24R1-SR 1.0 MP. An attacker can exploit this vulnerability by sending a specially crafted SOAP 'provision' operation message that targets the archive field within the Mobile Network Operator's internal Radio Access Network management network. This exploit allows unauthorized access to sensitive files, leading to potential data breaches. Nokia has released an update that incorporates enhanced security features utilizing libarchive APIs, which effectively mitigates the risk of this vulnerability in version 24R1-SR 1.0 MP and onwards.
Affected Version(s)
Nokia Single RAN All releases prior to 24R1-SR 1.0 MP
Nokia Single RAN 24R1-SR 1.0 MP and later