CVE-2025-24328 in Single RAN
Summary
by MITRE • 07/02/2025
Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later.
The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/02/2025
The vulnerability described in CVE-2025-24328 represents a critical stack overflow condition affecting Nokia Single RAN baseband OAM service components within mobile network infrastructure. This flaw exists in the handling of crafted SOAP set operation messages specifically within the internal Radio Access Network management network used by Mobile Network Operators. The issue manifests when the OAM service component receives maliciously formatted SOAP requests that trigger a buffer overflow condition, causing the service to crash and restart automatically. This vulnerability is particularly concerning as it operates within the core network management infrastructure that controls radio access network operations, potentially enabling unauthorized actors to disrupt network management services without directly affecting the radio access network functionality itself.
The technical exploitation of this vulnerability involves sending specially crafted SOAP messages that contain malformed data structures designed to overflow the stack memory allocated for processing set operation requests within the OAM service component. This type of vulnerability falls under CWE-121 Stack-based Buffer Overflow, which represents a classic and well-documented class of memory corruption vulnerabilities that can lead to service disruption and potentially more severe consequences depending on the execution context. The attack vector is specifically targeted at the internal RAN management network, suggesting that the vulnerability requires access to the trusted network segment where OAM communications occur, though this still represents a significant security boundary breach that could enable further attacks. The automatic restart mechanism prevents the need for additional exploitation steps to cause persistent disruption, though the service restart occurs without leaving any permanent damage to the baseband hardware or causing network-wide service degradation.
From an operational impact perspective, while the vulnerability does not result in complete network service outages or base station restarts, it does represent a significant availability concern for network management functions. The automatic restart of the OAM service component creates a potential denial-of-service condition for network operators who rely on these management capabilities for monitoring and controlling their radio access network elements. This disruption affects the operational integrity of network management systems and could potentially mask other security issues or prevent timely responses to legitimate network events. The vulnerability's impact is further complicated by the fact that it operates silently within the management network without alerting operators to the attempted exploitation, creating a potential blind spot in network monitoring and incident response capabilities. The issue affects Nokia Single RAN baseband systems running software versions prior to release 24R1-SR 1.0 MP, indicating that this represents a known weakness that was addressed through software updates and patches.
The mitigation strategy for this vulnerability involves immediate deployment of Nokia's corrected software release 24R1-SR 1.0 MP or later versions that contain the necessary code fixes to prevent the stack overflow condition. Network operators should implement comprehensive patch management procedures to ensure all affected OAM service components are updated promptly, as the vulnerability exists within the internal management network where access controls are typically less restrictive than those protecting core network services. Security monitoring should be enhanced to detect unusual patterns of OAM service restarts that could indicate exploitation attempts, and network segmentation strategies should be reviewed to limit access to the internal RAN management network to authorized personnel only. This vulnerability demonstrates the importance of maintaining up-to-date security patches for network management infrastructure, as even seemingly limited service disruptions can represent significant security concerns in telecommunications environments where operational continuity and security are paramount. The fix addresses the underlying buffer overflow condition through proper input validation and memory management practices, aligning with industry best practices for preventing stack-based buffer overflow vulnerabilities as outlined in various cybersecurity frameworks and standards.