Lena David

**Name of the Vulnerable Software and Affected Versions** BTS (affected versions not specified) **Description** The issue concerns an information disclosure vulnerability. Mobile network operator personnel connected over BTS Web Element Manager can read BTS service operation details performed by Nokia Care service personnel via SSH, regardless of their access privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NOKIA Airscale ASIKA Single RAN devices versions prior to 21B **Description** An issue was discovered in the Nokia Single RAN software releases, where certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources. This is due to an internal fault in the mobile network solution. **Recommendations** For versions prior to 21B, consider restricting access to the BTS embedded operating system (OS) resources to minimize the risk of exploitation. As a temporary workaround, review and adjust the privileges of software processes in the BTS internal software design to ensure they are appropriately limited. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NOKIA Airscale ASIKA Single RAN devices versions prior to 21B **Description** An issue was discovered in the Nokia BTS baseband unit diagnostic tool AaShell, which is disabled by default. If security hardenings are removed from a Nokia Single RAN BTS baseband unit by a CSP administrator, a directory path traversal provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network. **Recommendations** For versions prior to 21B, consider disabling the AaShell diagnostic tool until a patch is available to prevent potential exploitation. Restrict access to the BTS baseband unit internal filesystem to minimize the risk of unauthorized access. Ensure that security hardenings are not removed from the Nokia Single RAN BTS baseband unit to prevent this issue.

**Name of the Vulnerable Software and Affected Versions** NOKIA Airscale ASIKA Single RAN devices versions prior to 21B **Description** An issue was discovered where Nokia Single RAN commissioning procedures do not change the default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server continues to apply the default SSH public/private key values. Although these keys do not give access to BTS because service user authentication is username/password-based on top of SSH, they can be used to attempt MITM exploitation of BTS service user access when SSH is enabled for troubleshooting activities. **Recommendations** For versions prior to 21B, change the default SSH public/private key values to operator-specific values during the BTS deployment commissioning phase to prevent potential MITM exploitation. As a temporary workaround, consider restricting access to the SSH server and only enabling it when necessary for Nokia service personnel to perform troubleshooting activities.

**Name of the Vulnerable Software and Affected Versions** NOKIA Airscale ASIKA Single RAN devices versions prior to 21B **Description** An issue was discovered where if security hardenings are removed from the Nokia Single RAN BTS baseband unit by a CSP as a BTS administrator, the BTS baseband unit diagnostic tool AaShell allows unauthenticated access from the mobile network solution internal BTS management network to the BTS embedded Linux operating-system level. This access is possible because AaShell, which is disabled by default, can be accessed without authentication. **Recommendations** For versions prior to 21B, as a temporary workaround, consider disabling the AaShell diagnostic tool until a patch is available. Restrict access to the BTS baseband unit to minimize the risk of exploitation. Ensure that security hardenings are not removed from the Nokia Single RAN BTS baseband unit to prevent unauthenticated access.