Nokia SR Linux CVE-2025-9912

Exploitation requires two concrete prerequisites: (1) local or remote authenticated access to the Nokia SR Linux system - the AV:L CVSS vector confirms exploitation must originate from within the local system context, such as an SSH shell session or console login, not from an unauthenticated network position; and (2) a valid user account on the device, with the vendor-assigned PR:H suggesting at minimum a non-anonymous account, though whether a standard operator account suffices versus an elevated-but-non-root account is not explicitly stated in available data. Exploitation is NOT possible from unauthenticated network positions. External attackers must first achieve authenticated local access before this vulnerability is relevant. The AC:L rating indicates no race condition, specific timing, or environmental complexity is required once those two prerequisites are met.

The vendor-assigned CVSS 3.1 score of 6.3 (Medium) reflects the local attack vector (AV:L) and high privilege requirement (PR:H), which substantially constrain the exploitable population. However, the integrity and availability impacts are both High (I:H/A:H), meaning successful exploitation grants full control over the network OS - a significant operational consequence on routing infrastructure. The PR:H assignment is worth scrutiny: the description states 'authenticated user' without specifying that a pre-existing administrative account is required, so the actual entry threshold may be closer to PR:L (regular user authentication), which would raise the effective risk. No EPSS score was included in the available data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public exploit, indicating no widespread active exploitation at time of analysis. For network operators running SR Linux at scale, the real-world priority should be elevated: a successful escalation on a core router grants the attacker the ability to manipulate routing tables, extract credentials, and disrupt traffic - outcomes disproportionate to the medium CVSS score. The CVSS C:L assignment also likely underestimates actual confidentiality impact, since superuser execution on any Linux-based system implies full read access to all data.

An attacker who has obtained an authenticated local session on a Nokia SR Linux node - either through compromised operator credentials, a phishing campaign targeting network engineers, or lateral movement from another compromised host with management-plane access - triggers the improper privilege management flaw to escalate from their assigned user context to superuser. With root-level command execution on the router, the attacker can modify BGP or IS-IS routing configurations, exfiltrate management-plane secrets (certificates, SNMP community strings), or cause a controlled outage. No public proof-of-concept code has been identified at time of analysis.