Vulnerability · Published Jul 2, 2025 · Assigned by Nokia

CVE-2025-24330OAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management network

Medium 6.4

In plain English

A medium-severity path traversal in Nokia Single RAN from Nokia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software performed PlanId field input validations mitigate the reported path traversal issue.

Affected products (as reported)

Vendor	Product	Versions
Nokia	Nokia Single RAN	All the releases prior to 24R1-SR 1.0 MP

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Nokia Security Advisory