Eine Relative Path Traversal Schwachstelle in Nokia MantaRay NM

Successful exploitation of CVE-2025-24819 could allow an attacker to read sensitive configuration files, source code, or other critical data stored on the affected system. Depending on the permissions of the Software Manager application, an attacker might be able to modify or even delete files, leading to system instability or data loss. The blast radius is limited to the file system accessible by the application, but the potential for data compromise is significant. There are no known real-world exploits, but the path traversal nature of the vulnerability makes it a serious concern.

Organizations utilizing Nokia MantaRay NM in their network infrastructure, particularly those running versions prior to 25R1-NM, are at risk. This includes deployments where the Software Manager application is exposed to external networks or untrusted users. Shared hosting environments running MantaRay NM are also particularly vulnerable.

• linux / server:

journalctl -u manta-ray-nm | grep -i "path traversal"

• linux / server:

lsof | grep /opt/manta-ray/software_manager/  # Check for unusual file access

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2025-01-24
2. Veröffentlicht2026-04-07
3. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2025-24819 is to upgrade Nokia MantaRay NM to version 25R1-NM or later. If an immediate upgrade is not possible, restrict access to the Software Manager application and implement strict input validation on all file system paths. Consider using a Web Application Firewall (WAF) to filter out malicious requests. Monitor system logs for unusual file access patterns. No specific Sigma or YARA rules are currently available.