Nokia SR Linux CVE-2025-10262

Exploitation requires: (1) local access to the SR Linux node - either direct shell access or an authenticated SR Linux CLI/API session; (2) a user account with high privileges on the system, consistent with CVSS PR:H. The vulnerability cannot be triggered remotely without first establishing local authenticated access, and unauthenticated attackers or low-privilege accounts are not sufficient. Non-default configuration is not specified as a prerequisite - the flaw is in the format validation path that is inherently exercised during normal privileged operations. Limiting factors include the mandatory prior authentication at high-privilege level, local-only attack vector, and the fact that SR Linux management access is typically restricted to trusted network operators via out-of-band management networks.

The official CVSS 3.1 score of 6.3 (Medium) reflects a constrained threat model: AV:L requires physical or authenticated shell-level local access; PR:H means the attacker must already hold a high-privilege account on the system. This materially limits the attack surface to insider threats, compromised operator accounts, or post-initial-access lateral movement scenarios. The C:L assignment in the vendor vector is notable - gaining superuser privilege normally implies C:H, and this appears to understate the post-exploitation confidentiality impact; security teams should treat a successful exploit as a full node compromise. No EPSS score was provided in the source data. No KEV listing exists, and no public proof-of-concept has been identified, aligning with the Medium severity and the relatively high exploitation bar. For network operators running SR Linux as core or edge routing infrastructure, the integrity and availability impacts (both I:H/A:H) are material: superuser access on a routing node could disrupt BGP/IS-IS sessions, modify routing tables, or exfiltrate management-plane credentials. The realistic risk is highest in environments where multiple operators share a single SR Linux node with differentiated privilege tiers.

An attacker who has compromised or legitimately holds a high-privilege SR Linux operator account logs into the node's management CLI or API and submits a crafted input containing format string specifiers (e.g., %n or %x sequences) to a validation routine that processes configuration or command input. The format string is passed unsanitized to an underlying format function, enabling the attacker to corrupt stack memory or overwrite a function pointer, ultimately achieving arbitrary code execution in the context of the superuser. No public proof-of-concept is known at time of analysis, but the primitive is well-understood and the low attack complexity (AC:L) suggests the exploit path is straightforward for a skilled attacker once local access is obtained.