Radu Balaci

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband OAM service component versions prior to 24R1-SR 1.0 MP Description: The issue occurs when a crafted SOAP "set" operation message is sent within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network, causing the Nokia Single RAN baseband OAM service component to restart. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service. Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP "set" operation message within the MNO internal RAN management network to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP Description: The issue arises when a crafted SOAP "provision" operation message archive field is sent within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network, causing a path traversal issue. This has been mitigated in release 24R1-SR 1.0 MP and later by utilizing libarchive APIs with security options enabled. Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP "provision" operation message archive field within the MNO internal RAN management network until a patch is available.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP Description: The issue arises when a crafted SOAP "provision" operation message is sent with a malicious `PlanId` field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network, causing a path traversal issue. This has been mitigated in release 24R1-SR 1.0 MP and later by performing `PlanId` field input validations in the OAM service software. Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP "provision" operation message endpoint to minimize the risk of exploitation. Avoid using the `PlanId` field in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Single RAN baseband OAM service versions prior to 24R1-SR 0.2 MP Description: The Single RAN baseband OAM service is intended to run as an unprivileged service but initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive and could potentially allow actions beyond the intended scope of the OAM service, including gaining root privileges, accessing root-owned files, modifying them, and then returning them to root ownership. Recommendations: For versions prior to 24R1-SR 0.2 MP, update to release 24R1-SR 0.2 MP or later to restrict the OAM service software capabilities to the minimum necessary.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN AirScale baseband versions prior to 23R4-SR 3.0 MP Description: The issue allows an authenticated administrative user to access all physical boards after a single login to the baseband system board, without re-authentication when connecting to baseband capacity boards using the internal bsoc SSH service. This service is available internally within the baseband and through the internal backplane between the boards, using an SSH private key present on the baseband system board. The bsoc SSH capability was previously considered an administrative functionality but has been restricted to be available only to baseband root-privileged administrators to mitigate the possibility of misuse with lower-level privileges. Recommendations: For versions prior to 23R4-SR 3.0 MP, update to release 23R4-SR 3.0 MP or later to restrict the bsoc SSH capability to baseband root-privileged administrators and mitigate the issue.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP Description: The issue is related to an administrative shell input validation fault in the Nokia Single RAN baseband software. An authenticated admin user can potentially inject arbitrary commands for unprivileged baseband OAM service process execution by adding special characters to the baseband internal COMA config.xml file. The problem has been corrected in release 24R1-SR 1.0 MP and later by adding proper input validation to the OAM service process. Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the baseband internal COMA config.xml file to prevent potential command injection.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 23R2-SR 1.0 MP Description: The issue allows an attacker to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network. Recommendations: For versions prior to 23R2-SR 1.0 MP, update to version 23R2-SR 1.0 MP or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP Description: The issue is related to a SOAP message input validation flaw, which could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical exploit has been detected for this flaw. The problem has been corrected starting from release 24R1-SR 2.1 MP by adding sufficient input validation for received SOAP requests. Recommendations: For versions earlier than 24R1-SR 2.1 MP, update to release 24R1-SR 2.1 MP or later to mitigate the issue by adding sufficient input validation for received SOAP requests.