VulnerabilityModified

CVE-2023-25185

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.

HIGH 7.8EPSS 0.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-269, CWE-863
Affected: nokia/asika airscale firmware
Source: cve@mitre.org

References

https://Nokia.comProduct
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25185/Vendor Advisory
https://Nokia.comProduct
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25185/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.