What is the CVSS score of CVE-2025-24818?

CVE-2025-24818 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nokia are affected by CVE-2025-24818?

CVE-2025-24818 is a high-severity OS command injection vulnerability in Nokia MantaRay NM Log Search that allows authenticated adjacent network attackers to execute arbitrary commands, compromising…

How to fix or mitigate CVE-2025-24818?

Within 24 hours: Inventory all Nokia MantaRay NM deployments and document current versions; restrict network access to the Log Search application to essential administrators only. Within 7 days: Implement network segmentation or firewall rules limiting Log Search access to trusted subnets; disable the Log Search feature if operationally feasible pending patching. Within 30 days: Upgrade all affected instances to version 25R1-NM or later per Nokia's advisory; conduct access logs review for suspicious command execution patterns during the interim period.

Nokia CVE-2025-24818

EUVD-2025-209264 HIGH

Command Injection (CWE-77)

2026-04-07 Nokia

GHSA-gc74-chmx-fghj

Nokia Command Injection

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2025-209264

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:13 nvd

HIGH 8.0

DescriptionCVE.org

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.

AnalysisAI

OS command injection in Nokia MantaRay NM Log Search application allows authenticated adjacent network attackers to execute arbitrary OS commands with high impact to confidentiality, integrity, and availability. The vulnerability affects versions prior to 25R1-NM due to improper neutralization of special elements in OS commands (CWE-77). CVSS score of 8.0 reflects high severity with low attack complexity requiring low-level authentication from adjacent network position. No public exploit identified at time of analysis, though command injection vulnerabilities are well-understood and relatively straightforward to exploit once access requirements are met.

Technical ContextAI

This vulnerability stems from CWE-77 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The flaw exists in the Log Search application component of Nokia MantaRay NM, a network management platform. Command injection occurs when user-supplied input is passed to system shell commands without proper sanitization, allowing attackers to inject shell metacharacters or command separators to execute arbitrary commands. The CPE identifier cpe:2.3:a:nokia:mantaray_nm indicates this affects the MantaRay NM application software. The adjacent network attack vector (AV:A) suggests the vulnerable interface is accessible from the same network segment but not directly from the internet, typical of management interfaces in enterprise network management systems. Low privileges required (PR:L) indicates a standard authenticated user account is sufficient for exploitation, without requiring administrative credentials.

RemediationAI

Vendor-released patch: Organizations should immediately upgrade Nokia MantaRay NM to version 25R1-NM or later, which addresses the OS command injection vulnerability in the Log Search application. The upgrade should be prioritized for production deployments, particularly those where MantaRay NM is accessible from broader network segments or where multiple users have authenticated access. As interim risk mitigation while planning upgrades, organizations should restrict network access to MantaRay NM management interfaces using firewall rules or network segmentation, limit user account privileges to only those requiring Log Search functionality, and implement enhanced monitoring for suspicious command execution patterns in MantaRay NM logs. Complete remediation guidance and patch download information are available in Nokia's product security advisory at https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24818/ and additional technical details at https://nvd.nist.gov/vuln/detail/CVE-2025-24818.