Path Traversal Vulnerability in Nokia Single RAN Baseband Software
CVE-2025-24330

6.4MEDIUM

Key Information:

Vendor

Nokia
Status
Nokia Single Ran
Vendor
CVE Published:
2 July 2025

What is CVE-2025-24330?

A path traversal vulnerability has been identified in Nokia's Single RAN baseband software due to improper input validation in the PlanId field of SOAP 'provision' operation messages. This issue primarily affects communications within the Mobile Network Operator's internal Radio Access Network. When exploited, it can lead to unauthorized access to sensitive files and directories. The vulnerability is addressed in the software release 24R1-SR 1.0 MP and onward, which includes enhancements to the OAM service for input validation, thereby mitigating the path traversal risk.

Affected Version(s)

Nokia Single RAN All the releases prior to 24R1-SR 1.0 MP

Nokia Single RAN 24R1-SR 1.0 MP and later

References

https://www.nokia.com/about-us/security-and-privacy/produ...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-24330 : Path Traversal Vulnerability in Nokia Single RAN Baseband Software