CVE-2025-24329 in Single RAN
Summary
by MITRE • 07/02/2025
Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later.
Beginning with release 24R1-SR 1.0 MP, the OAM service software utilizes libarchive APIs with security options enabled, effectively mitigating the reported path traversal issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/02/2025
The vulnerability identified as CVE-2025-24329 represents a critical path traversal flaw within Nokia Single RAN baseband software affecting versions prior to release 24R1-SR 1.0 MP. This security weakness resides within the Mobile Network Operator's internal Radio Access Network management infrastructure, specifically within the Operations, Administration, and Maintenance (OAM) service software that handles SOAP provisioning operations. The vulnerability manifests when processing crafted SOAP "provision" operation messages containing maliciously constructed archive field data, creating an attack surface that could potentially allow unauthorized access to sensitive system resources.
The technical implementation of this flaw involves the improper handling of file paths during archive processing operations within the RAN management software. When the OAM service receives a malformed SOAP message with a specially crafted archive field, the underlying libarchive API processing does not adequately validate or sanitize the input paths, allowing attackers to manipulate the file system traversal behavior. This type of vulnerability maps directly to CWE-22 Path Traversal and CWE-77 Path Traversal in multiple contexts, as the flaw enables attackers to navigate the file system beyond intended boundaries. The vulnerability's exploitation potential is amplified within the RAN management network context where privileged access to baseband equipment is already established, making this an attractive target for attackers seeking to escalate privileges or extract sensitive operational data.
The operational impact of this vulnerability extends beyond simple file system access, as it could enable attackers to manipulate critical network configuration files, access proprietary software components, or potentially disrupt radio access network operations. Within the context of the ATT&CK framework, this vulnerability could be leveraged as part of the privilege escalation and persistence phases, allowing attackers to establish long-term access to the RAN infrastructure. The affected Nokia Single RAN baseband software represents a fundamental component of mobile network infrastructure, making this vulnerability particularly concerning as it could potentially impact thousands of network sites globally. The attack vector through the OAM service software means that exploitation requires access to the internal management network, but once achieved, could provide attackers with significant control over network operations and potentially enable further lateral movement within the network infrastructure.
Nokia's remediation approach for CVE-2025-24329 demonstrates a solid understanding of the vulnerability's root cause, implementing a security-focused solution by enabling specific security options within the libarchive API usage. The fix requires upgrading to release 24R1-SR 1.0 MP or later, which incorporates proper input validation and sanitization measures within the OAM service software. This approach aligns with industry best practices for preventing path traversal vulnerabilities by ensuring that file system operations are properly constrained and validated before processing. Organizations should prioritize upgrading their Nokia Single RAN baseband software installations to mitigate this vulnerability, as the security improvements in the newer releases provide comprehensive protection against the specific attack patterns that could exploit this flaw. The remediation also demonstrates the importance of maintaining up-to-date software versions in critical infrastructure environments, where vendor-provided security patches represent the most effective defense against known vulnerabilities.