Command Injection Vulnerability in Nokia Web Application

CVE-2025-24938

What is CVE-2025-24938?

A command injection vulnerability in Nokia's web application lets authenticated users execute arbitrary commands on the server's operating system. This flaw arises from improper validation of user input, enabling attackers with high-privilege access, such as administrators, to manipulate system commands. The vulnerability can be exploited when creating a new user via the User Management interface, posing risks to the entire network. As the affected component is accessible over the Internet, it significantly broadens the attack surface.

References