CVE-2025-24938: Insufficient Validation of Input while user creation
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) to the application has the potential execute commands on the operating system under the context of the webserver.
The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. Has the potential to inject command while creating a new User from User Management.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24938?
CVE-2025-24938 is classified as a critical vulnerability due to its potential for remote command execution on the operating system.
How do I fix CVE-2025-24938?
To mitigate CVE-2025-24938, update your Nokia Wavesuite Noc software to the latest version available that addresses this vulnerability.
What versions of Nokia Wavesuite Noc are affected by CVE-2025-24938?
CVE-2025-24938 affects Nokia Wavesuite Noc versions 23.6, 23.12, and 24.6.
Can CVE-2025-24938 be exploited remotely?
Yes, CVE-2025-24938 can be exploited by an attacker with high privileged access who can send unfiltered input to the system.
What are the potential consequences of CVE-2025-24938?
Exploitation of CVE-2025-24938 may allow an attacker to execute arbitrary commands on the underlying operating system, leading to data compromise or system integrity loss.