CVE-2022-28863 in NetAct
Summary
by MITRE • 07/24/2023
An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/21/2026
The vulnerability identified as CVE-2022-28863 resides within Nokia NetAct 22, a network management platform widely deployed in telecommunications environments. This issue represents a critical authorization flaw that allows authenticated attackers to bypass file upload restrictions through a specific parameter manipulation technique. The vulnerability manifests when an authenticated user navigates to the Site Configuration Tool section and leverages the /netact/sct directory parameter combined with operation=upload to execute arbitrary file uploads. This represents a severe privilege escalation vulnerability that directly violates the principle of least privilege and proper access controls within the application's security architecture.
The technical flaw stems from inadequate input validation and insufficient authorization checks within the file upload mechanism. The system fails to properly validate file types, extensions, or content before processing uploads, creating an unrestricted file upload vulnerability that aligns with CWE-434. The attack vector exploits a specific parameter injection pattern where the operation=upload parameter is manipulated in conjunction with the directory path, allowing attackers to write files to arbitrary locations within the web application's file system. This vulnerability essentially creates a backdoor for code execution and persistent access within the network management infrastructure.
The operational impact of this vulnerability extends far beyond simple unauthorized file uploads, as it provides attackers with the capability to establish persistent access to critical network infrastructure. An authenticated attacker with access to the web interface can deploy malicious payloads such as web shells, backdoors, or other malicious software that could compromise the entire network management system. This vulnerability directly enables several attack patterns documented in the MITRE ATT&CK framework, particularly those related to privilege escalation, persistence, and execution through legitimate system processes. The compromised system could serve as a launching point for lateral movement throughout the network, potentially affecting core telecommunications infrastructure and customer data.
Organizations utilizing Nokia NetAct 22 should immediately implement multiple layers of mitigation strategies to address this vulnerability. The primary recommendation involves implementing strict file type validation and content inspection mechanisms that prevent execution of potentially malicious files through the upload process. Network segmentation and access control measures should be enhanced to limit access to the Site Configuration Tool section to only authorized personnel with legitimate business needs. Additionally, implementing web application firewalls and monitoring for unusual upload patterns can help detect and prevent exploitation attempts. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities within the network management infrastructure, while also ensuring that all system components are updated with the latest security patches from Nokia to address this and related vulnerabilities in the platform.