Nokia vulnerabilities
We track 55 vulnerabilities in Nokia products across 40 products. 55 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Nokia vulnerabilities
- 7.8 High severity
Nokia 1830 Global Express (GX): Improper Access Control
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue oc
- 7.6 High severity
WaveSuite: Improper Access Control
WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding
- 7.8 High severity
MantaRay NM: Improper Privilege Management
Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the
- 7.8 High severity
MantaRay NM: Unrestricted Upload of File with Dangerous Type
Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.
- 8.0 High severity
MantaRay NM: Improper Neutralization of Special Elements used in a Command
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.
- 8.0 High severity
MantaRay NM: Improper Neutralization of Special Elements used in an OS Command
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.
- 8.8 High severity
Impact Mobile: Improper Control of Generation of Code
An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attac
- 8.0 High severity
Nokia ONT: Improper Neutralization of Special Elements used in an OS Command
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated at
- 9.8 Critical severity
MTC-9: Missing Authentication for Critical Functionality
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
- 9.8 Critical severity
MTC-9: Missing Authentication for Critical Functionality
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
- 7.5 High severity
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users…
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R2
- 8.6 High severity
MTC-9: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.
- 8.4 High severity
CBIS,NCS: Improper Neutralization of Special Elements used in a Command
The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the su
- 8.8 High severity
CBIS,NCS: Authentication Bypass Using an Alternate Path or Channel
The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the
- 8.4 High severity
WaveSuite NOC: Improper Neutralization of Special Elements used in an OS Command
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) to the application has the potential execute commands on the operating system under the c
- 9.0 Critical severity
WaveSuite NOC: Improper Control of Filename for Include/Require Statement in PHP Program
File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the
- 9.0 Critical severity
WaveSuite NOC: Improper Neutralization of Special Elements used in an OS Command
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An atta
- 7.8 High severity
G42: Incorrect Privilege Assignment
The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of ser
- 7.1 High severity
Nokia Single RAN AirScale (Flexi Multiradio is…: Authentication Bypass Using an Alternate Path or Channel
Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system
- 7.3 High severity
SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR…: Incorrect Permission Assignment for Critical Resource
Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well a
- 9.0 Critical severity
tnms: Incorrect Privilege Assignment
The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
- 7.2 High severity
tnms: Improper Limitation of a Pathname to a Restricted Directory
In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory.
- 7.7 High severity
tnms: Cleartext Storage of Sensitive Information
In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop
- 8.4 High severity
hit_7300: Improper Privilege Management
An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface.
- 8.8 High severity
hit_7300: Use of Hard-coded Credentials
An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attackers to access the appliance operating system (with highest privileges) via an SSH connection.
- 8.8 High severity
hit_7300: Cleartext Storage of Sensitive Information
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.
- 7.3 High severity
Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a…
Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus (versionCode='31', versionName='12') that allows local third-party apps to execute arbitrary AT comma
- 8.8 High severity
Network Functions Manager For Transport: Improper Neutralization of Special Elements used in an SQL Command
In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.
- 8.8 High severity
Network Functions Manager For Transport: Improper Neutralization of Special Elements used in an OS Command
In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.
- 9.8 Critical severity
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for…
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting
- 8.8 High severity
NOKIA G-040W-Q: Weak Password Requirements
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing
- 7.2 High severity
NOKIA G-040W-Q: Improper Neutralization of Special Elements used in an OS Command
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system
- 9.8 Critical severity
NOKIA G-040W-Q: Missing Authentication for Critical Functionality
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remot
- 9.8 Critical severity
NOKIA G-040W-Q: Improper Restriction of Excessive Authentication Attempts
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypa
- 7.8 High severity
wavelite_metro_200_and_fan: Improper Access Control
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS
- 8.8 High severity
Access Management System: Improper Control of Generation of Code
An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS server, could inject code in the PING function. The privileges of the command executed depend on the u
- 7.5 High severity
Service Router Linux: Always-Incorrect Control Flow Implementation
Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.
- 8.8 High severity
Netact: Cross-Site Request Forgery
/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does no
- 8.8 High severity
Netact: Improper Neutralization of Formula Elements in a CSV File
An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed
- 8.8 High severity
Netact: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with