Wavesuite
Monthly
Privilege escalation in Nokia WaveSuite's CPB Log Files feature allows authenticated low-privilege users to access pages reserved for higher-privilege roles by directly navigating to their URLs, bypassing server-side role enforcement entirely. Affected versions confirmed by EUVD-2026-68372 include WaveSuite 23.6, 24.6, 24.12, and 25.6. No public exploit code exists and no active exploitation has been observed (EPSS: 0.14%, 4th percentile), though the trivial attack mechanism - crafting a direct HTTP request - makes this a meaningful risk for insider threat and compromised low-privilege account scenarios in telecom environments.
Privilege escalation in Nokia WaveSuite's CPB Log Files feature allows authenticated low-privilege users to access pages reserved for higher-privilege roles by directly navigating to their URLs, bypassing server-side role enforcement entirely. Affected versions confirmed by EUVD-2026-68372 include WaveSuite 23.6, 24.6, 24.12, and 25.6. No public exploit code exists and no active exploitation has been observed (EPSS: 0.14%, 4th percentile), though the trivial attack mechanism - crafting a direct HTTP request - makes this a meaningful risk for insider threat and compromised low-privilege account scenarios in telecom environments.