Nokia vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-40463 WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature.High 7.6 · Aug 31, 2026
• CVE-2025-7406 Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalHigh 7.8 · Jun 30, 2026
• CVE-2025-24815 Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation.High 7.8 · Jun 30, 2026
• CVE-2025-24818 Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search High 8 · Apr 7, 2026
• CVE-2025-24817 Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom ColHigh 8 · Apr 7, 2026
• CVE-2021-35486 A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entiHigh 8.1 · Mar 3, 2026
• CVE-2021-35485 The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executablHigh 8 · Mar 3, 2026
• CVE-2021-35484 Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/reHigh 8.2 · Mar 3, 2026
• CVE-2025-9974 The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level commanHigh 8 · Feb 2, 2026
• CVE-2023-49565 The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint.High 8.4 · Sep 18, 2025
• CVE-2023-49564 The CBIS/NCS Manager API is vulnerable to an authentication bypass.High 8.8 · Sep 18, 2025
• CVE-2025-24938 The web application allows user input to pass unfiltered to a command executed on the underlying operating system.High 8.4 · Jul 21, 2025
• CVE-2025-24937 File contents could be read from the local file system by an attacker.Critical 9 · Jul 21, 2025
• CVE-2025-24936 The web application allows user input to pass unfiltered to a command executed on the underlying operating system.Critical 9 · Jul 21, 2025
• CVE-2025-24332 Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband sysHigh 7.1 · Jul 2, 2025
• CVE-2023-6729 Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege High 7.3 · Oct 17, 2024
• CVE-2023-38293 Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus (High 7.3 · Apr 22, 2024
• CVE-2022-39822 In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter.High 8.8 · Dec 25, 2023
• CVE-2022-39818 In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter.High 8.8 · Dec 25, 2023
• CVE-2023-22618 If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipuHigh 8.1 · Oct 4, 2023
• CVE-2022-41763 An issue was discovered in NOKIA AMS 9.7.05.High 8.8 · Sep 5, 2023
• CVE-2023-41376 Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.High 7.5 · Aug 29, 2023
• CVE-2022-30280 /SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF.High 8.8 · Jul 24, 2023
• CVE-2022-28864 An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section.High 8.8 · Jul 24, 2023
• CVE-2022-28863 An issue was discovered in Nokia NetAct 22.High 8.8 · Jul 24, 2023