Nokia MantaRay NM CVE-2025-7406

Exploitation requires the attacker to already hold MantaRay NM administrative (local admin) privileges and local access to the host running a version prior to NM 25R1-NM; the concrete prerequisite is the presence of the over-permissive sudo command allowance for those admin accounts, which is the abused mechanism. Limiting factors: it is strictly local (AV:L) with no remote or unauthenticated path, demands a pre-existing privileged foothold (PR:L), and can be neutralized by tightening the sudoers command list - so realistic risk is confined to insiders or attackers who have already compromised an admin account.

Signals are consistent and point to a real but contained risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes local access with low complexity, already-held low privileges, no user interaction, and full CIA impact - i.e. a reliable escalation primitive once a foothold exists, not an internet-facing entry point. EPSS is low (0.17%, 7th percentile) and there is no CISA KEV listing and no public exploit identified, so this is not a mass-exploited or wormable issue. The key caveat: PR:L in the vector reflects that the attacker must already possess MantaRay 'local admin' privileges, which the description confirms; this is a post-compromise/insider escalation rather than a remote break-in. No SSVC decision data was supplied. Overall this is a meaningful priority for hardening privileged hosts but ranks below network-reachable unauthenticated flaws.

An operator, contractor, or attacker who has already obtained MantaRay NM local-admin credentials logs into the management host and invokes a permitted sudo command that allows shell escape or writing to a root-owned location. They spawn a root shell, gaining full control of the host filesystem and the ability to run any command as root. No public exploit code has been identified, but the low attack complexity makes reliable exploitation straightforward once admin access is held.