CVEvulnerability

CVE-2023-25186

2.8 LOW Published 2023-06-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-06-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.1 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
CVSS 3.1 ([email protected])
2.8 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-22

Description

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Single RAN BTS baseband unit, a directory path traversal in the Nokia BTS baseband unit diagnostic tool AaShell (which is by default disabled) provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network.

Affected configurations

• nokia asika airscale firmware 19b • nokia asika airscale firmware 20a • nokia asika airscale firmware 20b • nokia asika airscale firmware 20c • nokia asika airscale firmware 21a

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References