Nokia MantaRay NM CVE-2025-24816

Exploitation requires a valid, authenticated low-privilege account on the Nokia MantaRay NM platform (CVSS PR:L confirms authentication is mandatory - unauthenticated exploitation is not possible). The attacker must have network-level access to the NM API (AV:N), which in telecom environments is typically restricted to internal management networks. No user interaction from a higher-privileged user is required. Exploitation is bounded to MantaRay NM versions prior to 25R2-NM. The key limiting factor is the authentication prerequisite: an attacker must already possess valid NM credentials, limiting realistic threat actors to malicious insiders, compromised operator accounts, or attackers who have separately obtained valid credentials. The 'Authentication Bypass' tag in the source data refers specifically to bypass of API authorization controls post-login, not bypass of the authentication mechanism itself.

The CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity flaw that requires authenticated access and delivers high confidentiality impact with no integrity or availability consequence. EPSS at 0.18% (7th percentile) is very low, indicating minimal observed exploitation probability in the near term. The absence from CISA KEV and no identified public POC are consistent with this low EPSS signal. The source tag 'Authentication Bypass' is potentially misleading - the CVSS PR:L vector and description both confirm authentication is required; what is bypassed is the authorization layer post-login, not the authentication mechanism itself. The confidentiality-only impact scope is a real constraint: while sensitive NM data (network topology, device credentials, configuration) could be exposed, the attacker cannot modify or disrupt the platform. Net assessment: this is a real, actionable vulnerability for telecom operators, but not an emergency - prioritize patching within normal maintenance cycles unless untrusted authenticated users exist in the environment.

An authenticated low-privilege operator account - for example, a read-only monitoring user - sends crafted API requests targeting endpoints or resource identifiers normally restricted to administrative roles. Because server-side authorization checks are insufficient, the API returns confidential data such as network element configurations, topology maps, or stored credentials. No public exploit code has been identified, but the low attack complexity (AC:L) means no special tooling or race conditions are required beyond valid credentials and knowledge of the API structure.