Login Request a demo
Medium severity · published Jul 2, 2025
CVE-2025-24328
OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Nokia Single RAN · Nokia
All releases prior to 24R1-SR 1.0 MP are affected. · source: vendor
Affected product
NS
Nokia Single RAN
Nokia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24328
www.nokia.com
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24328/
More from Nokia Single RAN
6.4
CVE-2025-24333
Administrative user shell input validation fault
6.4
CVE-2025-24331
Nokia Single RAN baseband OAM service extensive capabilities
6.4
CVE-2025-24330
OAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management network
6.4
CVE-2025-24329
OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network
3.3
CVE-2025-24334
The Nokia Single RAN baseband reveals its software version through the MNO internal RAN management network