EUVD-2025-210369
GHSA-2wj6-jgr2-x79w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-priv account
-
DeliveryAccess file-upload feature
-
ExploitSubmit malicious file bypassing type check
-
ExecutionFile written to system
-
PersistExecute payload in app context
-
ImpactFull host compromise (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) an authenticated MantaRay NM account at low privilege (CVSS PR:L) and (2) local access per the CVSS local attack vector (AV:L), with no user interaction needed (UI:N). The concrete prerequisite named in the description is access to MantaRay NM's file-upload functionality combined with the ability to supply a file type that the insufficient validation fails to reject. Limiting factors: the attacker must already be authenticated and have local/management-plane reach to the system, so anonymous internet-based exploitation is not supported by the published vector; only releases prior to 25R2-NM are affected. |
| Impact | Signals point to a genuine but constrained risk rather than a mass-exploitation emergency. The CVSS base score of 7.8 is driven by High impact across C/I/A, but the vector is AV:L/AC:L/PR:L/UI:N - meaning local access and existing low-privilege authentication are prerequisites, which substantially narrows the attacker population versus a network-facing unauthenticated bug. EPSS is very low (0.18%, 7th percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. Note a data inconsistency worth verifying: CWE-434 unrestricted file upload is most commonly a network/web-facing issue, yet the published vector is AV:L (local) - defenders should confirm with Nokia whether the upload endpoint is reachable remotely by authenticated users, as that would materially change exposure. Overall this is a 'patch in normal cycle' item for affected operators, prioritized higher where MantaRay NM accounts have broad user populations. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged MantaRay NM account (or has compromised one) uses the file-upload feature to submit a malicious file - e.g., a server-executable script - that bypasses the weak type check. Once written to the system, the file is executed or interpreted in the application context, giving the attacker control over data and the host. No public exploit code is referenced, and the CVSS local vector implies the actor needs existing access to the system or management plane. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Arbitrary file upload in Nokia MantaRay NM (network management) prior to 25R2-NM allows an authenticated, low-privileged attacker to bypass insufficient file-type validation and place malicious files on the host, leading to full compromise of confidentiality, integrity, and availability (CVSS 7.8). The flaw is a CWE-434 unrestricted upload; the CVSS vector specifies a local attack vector (AV:L) rather than remote network exploitation. No public exploit identified at time of analysis, and the EPSS score is very low (0.18%, 7th percentile).
RemediationAI
Upgrade to Nokia MantaRay NM 25R2-NM or later, the first release that contains the fix per the EUVD affected-version data (Patch available per vendor advisory); confirm the exact patched build against the Nokia product security advisory at https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24815/. Until the upgrade is applied, reduce risk by tightening account access - limit and audit the low-privilege accounts that can reach upload functionality, since exploitation requires authenticated (PR:L) and local (AV:L) access; restrict network/management-plane access to the MantaRay NM host to trusted operators only; and monitor the upload directories and web/application roots for unexpected executable or script files. The trade-off of restricting upload-capable accounts is reduced operational flexibility for legitimate users, so scope changes to non-essential roles first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nokia MantaRay NM is Nokia's converged network management platform used by carriers and large enterprises to operate and monitor mobile/transport network elements. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler validates file type insufficiently - typically trusting client-supplied content-type or extension rather than verifying actual content - so an attacker can submit executable or otherwise dangerous file types. The single affected CPE is cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*, indicating the application itself (all versions below the fixed release) rather than a specific embedded library.
Know when Mantaray Nm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated low-privilege account (PR:L) and local/management-plane access (AV:L); successful upload yields code execution with full High impact to C/I/A.
Primary rating from Vendor (Nokia).
CVSS VectorVendor: Nokia
Lifecycle Timeline
3DescriptionCVE.org
Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.
Executive ViewAI
Nokia MantaRay NM (network management platform) versions prior to 25R2-NM are vulnerable to authenticated local file upload attacks enabling full system compromise. This threatens your network operations and security visibility, as compromised management infrastructure can be used to manipulate network policies, disable monitoring, and affect enterprise-wide network operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Mantaray Nm
View allOS command injection in Nokia MantaRay NM Log Search application allows authenticated adjacent network attackers to exec
OS command injection in Nokia MantaRay NM Symptom Collector application allows authenticated adjacent network attackers
Local privilege escalation in Nokia MantaRay NM (network management) lets an attacker who already holds local administra
Insufficient authorization enforcement in the Nokia MantaRay NM API allows authenticated low-privilege users to retrieve
Relative path traversal in Nokia MantaRay NM Software Manager allows authenticated local network attackers to read sensi
Exploit-DB