Critical severity · published Jul 21, 2025
CVE-2025-24937
File contents could be read from the local file system by an attacker
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on.
The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WN
Wavesuite Noc · Nokia
23.6; 23.12; 24.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24937
Vendor Advisory
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/
More from Wavesuite Noc
9.0
CVE-2025-24936
The web application allows user input to pass unfiltered to a command executed on the underlying operating system
8.4
CVE-2025-24938
The web application allows user input to pass unfiltered to a command executed on the underlying operating system
