CVE-2021-26597

Name of the Vulnerable Software and Affected Versions Nokia NetAct version 18A

Description A remote user, authenticated to the Nokia NetAct Web Page, can upload potentially dangerous files without restrictions. This is achieved by visiting the Site Configuration Tool web site section and using the /netact/sct API endpoint with the dir parameter in conjunction with the operation=upload value.

Recommendations For Nokia NetAct version 18A, restrict access to the /netact/sct API endpoint to prevent arbitrary file uploads until a fix is available. As a temporary workaround, consider disabling the file upload functionality via the operation=upload value to minimize the risk of exploitation.