Nokia NSP CVE-2026-40465

Exploitation requires that a victim NSP user follow a crafted URL containing a malicious redirect or URL parameter - User Interaction is mandatory (UI:R per CVSS). The NSP instance must be network-reachable by the attacker (AV:N) to deliver the URL, or the attacker must have another channel to place the link before the victim. High Complexity (AC:H) reflects that successful exploitation depends on social engineering: the attacker must craft a convincing pretext to induce the victim to click. No authentication is required of the attacker (PR:N). Exploitation is limited by: NSP deployments isolated to internal networks that prevent external URL delivery; users trained to inspect redirect URLs before clicking; and the niche nature of NSP as a specialized carrier-grade platform, which reduces the attacker's likelihood of identifying and targeting valid user accounts.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (score 5.3) presents a mixed picture. Network accessibility (AV:N) and no authentication requirement from the attacker's side (PR:N) suggest broad potential reach, particularly if NSP management interfaces are internet-exposed. However, High Complexity (AC:H) reflects the social engineering dependency - a user must be induced to click a crafted URL - and required User Interaction (UI:R) further constrains exploitability. The C:H impact is defensible given that NSP manages critical network infrastructure, meaning harvested credentials carry high downstream value. EPSS at 0.14% (4th percentile) is consistent with no mass exploitation; open redirect vulnerabilities in niche management platforms rarely attract automated exploitation. No KEV listing and no public POC align with the low EPSS signal. Real-world priority is low for air-gapped or internally-only-accessible NSP deployments, moderate where NSP portals are externally reachable and users may receive phishing links from external actors.

An attacker identifies an externally accessible Nokia NSP portal and crafts a legitimate-looking NSP URL with a malicious value in the redirect parameter pointing to an attacker-controlled phishing page. The attacker delivers this URL to an NSP administrator or operator via email or other channel; upon clicking, the user is transparently forwarded to the phishing site where NSP credentials or session tokens may be harvested. No public exploit code is known at time of analysis.