Platform
linux
Component
mantaray-nm
Fixed in
25.0.1
CVE-2025-24817 represents a command injection vulnerability discovered in the Nokia MantaRay NM network management system. This flaw allows an attacker to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized access and control. The vulnerability affects versions 1.0.0 and all versions prior to 25R1-NM (exclusive). A patch is available in version 25R1-NM.
CVE-2025-24817 in Nokia MantaRay NM exposes a vulnerability within the Symptom Collector application, allowing for OS command injection. This stems from improper neutralization of special characters used within OS commands. A malicious actor could leverage this to execute arbitrary commands on the underlying system, potentially compromising the confidentiality, integrity, and availability of data and services. The risk is significant, particularly in environments where MantaRay NM manages sensitive information or controls critical infrastructure. The absence of a KEV (Knowledge Engineering Vector) suggests that the severity and specific impact are still under evaluation, highlighting the need to apply the fix promptly.
The vulnerability resides within the Symptom Collector application of Nokia MantaRay NM. An attacker could exploit it by sending malicious inputs containing OS commands. These commands would then be executed with the privileges of the user running the Symptom Collector application. Exploitation could occur through a web interface, API, or any other entry point that allows interaction with the Symptom Collector application. The complexity of exploitation will depend on the specific system configuration and existing security measures.
Exploit Status
EPSS
0.11% (29% percentile)
Nokia has released version 25R1-NM to address this vulnerability. It is strongly recommended to upgrade to this version as soon as possible. Prior to applying the update, a full system backup is crucial to enable restoration in case of issues. Furthermore, reviewing system logs for signs of exploitation is advised. Implementing strict access controls and least privilege principles can also help mitigate the impact of a potential exploit. Network and system activity monitoring can aid in detecting and responding to any exploitation attempts.
Actualice Nokia MantaRay NM a una versión posterior a 25R1-NM para mitigar la vulnerabilidad de inyección de comandos del sistema operativo. Consulte la advisory de seguridad de Nokia para obtener instrucciones detalladas y la versión corregida específica.
Vulnerability analysis and critical alerts directly to your inbox.
It's an OS command injection vulnerability in Nokia MantaRay NM.
Upgrade to version 25R1-NM as soon as possible.
It's a Knowledge Engineering Vector; indicating that severity and impact are being evaluated.
Review system logs for suspicious activity.
Implement strict access controls and monitor network activity.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.