Medium severity · published May 8, 2026
CVE-2022-45899
Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search…
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
Broadcast Message Center · Nokia
before 13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45899
Not Applicable
https://nokia.com
Exploit
https://www.exploit-db.com/exploits/51896
More from Broadcast Message Center
6.5
CVE-2021-35487
Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for…