What is the CVSS score of CVE-2025-24330?

CVE-2025-24330 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Noki are affected by CVE-2025-24330?

Organizations using Nokia Single RAN baseband software with should be aware of moderate risk from CVE-2025-24330, a path traversal vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2025-24330?

Within 30 days: Identify affected systems running Nokia Single RAN baseband software with and apply vendor patches as part of regular patch cycle. Review file handling controls.

Noki CVE-2025-24330

EUVD-2025-19736 MEDIUM

Path Traversal (CWE-22)

2025-07-02 b48c3b8f-639e-4c16-8725-497bc411dad0

Path Traversal

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19736

Analysis Generated

Mar 16, 2026 - 01:55 vuln.today

CVE Published

Jul 02, 2025 - 09:15 nvd

MEDIUM 6.4

DescriptionCVE.org

Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later.

Beginning with release 24R1-SR 1.0 MP, the OAM service software performed PlanId field input validations mitigate the reported path traversal issue.