Mantaray Nm EUVD-2025-209264

Real-world risk assessment reveals moderate-to-high priority concerns tempered by access constraints. The CVSS 3.1 score of 8.0 (High) reflects maximum impact across confidentiality, integrity, and availability (C:H/I:H/A:H), with low attack complexity (AC:L) and no user interaction required (UI:N). However, exploitation requires adjacent network access (AV:A) and low-level authentication (PR:L), significantly limiting the attack surface compared to unauthenticated remote vulnerabilities. No EPSS score is provided, but command injection vulnerabilities historically demonstrate moderate exploitation probability when access requirements are met. No confirmed active exploitation (no KEV listing) and no public exploit identified at time of analysis reduces immediate urgency. The SSVC framework considerations suggest: exploitation status is currently proof-of-concept level, technical impact is total system compromise, but automatable exploitation is constrained by authentication and network positioning requirements. Priority should be elevated for organizations where MantaRay NM is accessible from less-trusted network segments or where low-privilege user accounts are broadly distributed.

An attacker with valid low-privilege credentials to Nokia MantaRay NM gains access to the management interface from an adjacent network position, such as a corporate LAN segment or compromised network device. The attacker navigates to the Log Search application and injects shell metacharacters or command separators into search parameters that are improperly sanitized before being passed to underlying OS commands. This allows execution of arbitrary system commands with the privileges of the MantaRay NM application process, potentially leading to complete system compromise, extraction of sensitive network configuration data, manipulation of network management operations, or pivoting to managed network devices.