Mantaray Nm EUVD-2025-209263

Real-world risk assessment reveals moderate actual threat despite high CVSS 8.0 score. The CVSS vector indicates adjacent network attack vector (AV:A), meaning attackers must have access to the local network segment rather than remote internet access, which significantly reduces the attack surface compared to network-exploitable vulnerabilities. Low-privilege authentication is required (PR:L), preventing completely unauthenticated exploitation. Attack complexity is low (AC:L) once network access is obtained. The EPSS score of 0.06% (19th percentile) indicates minimal observed exploitation activity in the wild, suggesting this vulnerability is not currently being actively targeted. No CISA KEV listing confirms no known active exploitation campaigns. The SSVC framework would classify this as: exploitation status (none public), automatable (no, requires adjacent network position), technical impact (high due to full CIA triad compromise). Priority depends heavily on network segmentation - organizations with well-isolated management networks face substantially lower risk than those with flat network architectures. This represents a genuine internal threat or supply-chain risk rather than a mass-exploitation scenario.

An attacker with low-privilege credentials to Nokia MantaRay NM gains access to the adjacent management network through compromised employee credentials or a rogue device connected to the management VLAN. The attacker accesses the Symptom Collector application and submits specially crafted input containing shell metacharacters (such as semicolons or pipe symbols) into vulnerable parameters. Because the application fails to sanitize this input before passing it to underlying OS commands, the injected commands execute with the privileges of the MantaRay NM application process, potentially granting full system access to modify network configurations, exfiltrate sensitive network topology data, or establish persistent backdoors within the telecom management infrastructure.