What is the CVSS score of CVE-2025-24817?

CVE-2025-24817 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nokia are affected by CVE-2025-24817?

CVE-2025-24817 is a high-severity OS command injection vulnerability in Nokia MantaRay NM Symptom Collector that allows authenticated adjacent network users to execute arbitrary commands with full…

How to fix or mitigate CVE-2025-24817?

Within 24 hours: Inventory all Nokia MantaRay NM Symptom Collector instances and document current versions. Restrict network access to the Symptom Collector to trusted administrative networks only using firewall rules. Within 7 days: Implement enhanced monitoring and logging on affected systems for command execution activities; review access logs for unauthorized authenticated sessions. Contact Nokia support to obtain availability status for version 25R1-NM patch release timeline. Within 30 days: Plan upgrade to version 25R1-NM or later once released; if available, apply immediately upon release and validate in test environment first.

Nokia CVE-2025-24817

EUVD-2025-209263 HIGH

OS Command Injection (CWE-78)

2026-04-07 Nokia

GHSA-gfh5-8jx4-qc72

Command Injection Nokia

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2025-209263

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:09 nvd

HIGH 8.0

DescriptionCVE.org

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.

AnalysisAI

OS command injection in Nokia MantaRay NM Symptom Collector application allows authenticated adjacent network attackers to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The vulnerability affects all versions prior to 25R1-NM and requires low-privilege authenticated access over adjacent network with low attack complexity. No public exploit identified at time of analysis, with EPSS exploitation probability at 0.06% (19th percentile), indicating relatively low observed real-world exploitation likelihood despite the high CVSS score.

Technical ContextAI

This vulnerability (CWE-78: OS Command Injection) affects the Symptom Collector application component within Nokia MantaRay Network Management (NM) platform. Command injection vulnerabilities occur when an application passes unsanitized user input directly to system shell commands, allowing attackers to inject malicious commands using special characters like semicolons, pipes, or backticks. The affected product (cpe:2.3:a:nokia:mantaray_nm) is Nokia's network management solution used for telecom infrastructure monitoring and configuration. The improper neutralization of special elements means the application fails to validate or sanitize input parameters before incorporating them into OS-level command execution, creating a direct pathway from user input to system shell execution.

RemediationAI

Vendor-released patch: Nokia MantaRay NM version 25R1-NM. Organizations should immediately upgrade all MantaRay NM installations to version 25R1-NM or later to remediate this command injection vulnerability. The complete remediation guidance and patch distribution information is available in Nokia's official product security advisory at https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24817/. As an interim compensating control before patching, organizations should restrict network access to the MantaRay NM management interface to only essential administrative networks using network segmentation, firewall rules, or VPN requirements. Review and minimize the number of accounts with access to the Symptom Collector application functionality, and implement enhanced logging and monitoring for suspicious command execution activity on MantaRay NM systems until patching is complete.