Nokia Single RAN AirScale prior 23R4-SR 3.0 MP Internal bsoc SSH Service improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in Nokia Single RAN AirScale. This impacts an unknown function of the component Internal bsoc SSH Service. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2025-24332. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Nokia Single RAN AirScale and classified as critical. This issue affects an unknown functionality of the component Internal bsoc SSH Service. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later

The advisory is shared at nokia.com. The identification of this vulnerability is CVE-2025-24332 since 01/20/2025. The exploitation is known to be easy. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 23R4-SR 3.0 MP eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19703). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Nokia

Name

• Single RAN AirScale

License

• commercial

Website

• Vendor: https://www.nokia.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion