Nokia vulnerabilities
We track 55 vulnerabilities in Nokia products across 40 products. 55 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Nokia vulnerabilities
- 7.0 High severity
Asika Airscale Firmware: Use of Hard-coded Credentials
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP
- 7.8 High severity
Asika Airscale Firmware: Improper Privilege Management
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia Single RAN BTS baseband unit, the BTS baseband unit diagnostic tool AaShell (which is by default disa
- 7.8 High severity
Asika Airscale Firmware: Improper Privilege Management
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high priv
- 7.8 High severity
Web Element Manager: Improper Privilege Management
A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network solution architecture. T
- 8.8 High severity
One-nds: Incorrect Default Permissions
In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands.
- 8.8 High severity
Netact: Improper Control of Generation of Code
An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an exte
- 7.8 High severity
ASIK AirScale: Improper Access Control for Volatile Memory Containing Boot Code
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs.
- 7.1 High severity
ASIK AirScale: Assumed-Immutable Data is Stored in Writable Memory
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a
- 8.8 High severity
ASIK AirScale: Improper Access Control for Volatile Memory Containing Boot Code
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary cod
- 8.4 High severity
Fastmile Firmware: Use of Hard-coded Credentials
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.
- 8.8 High severity
Airframe Bmc Web Gui R18 Firmware: Missing Authorization
Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not v
- 7.5 High severity
1350 Optical Management System: Insertion of Sensitive Information into Log File
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem.
- 8.8 High severity
1350 Optical Management System: Improper Neutralization of Special Elements used in an OS Command
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execute commands on the operating system.
- 8.8 High severity
1350 Optical Management System: Improper Neutralization of Special Elements used in an SQL Command
In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker. Through the injection of arbitrary SQL statements, a potential authenticated attacker can modify query syntax and perform unauthorized (and
- 9.8 Critical severity
1350 Optical Management System: Improper Neutralization of Special Elements used in an OS Command
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated users to execute commands on the operating system.