CVE-2025-24937

The web application allows including (include) arbitrary files into a resource, which is then downloaded and executed by the web server — corresponding to a classic Remote File Inclusion (RFI) vulnerability classified as CWE-98. An attacker can thus read the contents of files from the server's local file system and also place malicious code in the included file. The vulnerable component is accessible from the network (bound to the network stack), which means the scope of potential attackers covers the entire Internet. Low privilege level and access from a neighboring network (vector AV:A) are required.

An attacker can read sensitive files from the server file system, execute arbitrary code in the context of the web server, and completely take over the web application and container environment in which it is running — compromising the confidentiality, integrity, and availability of the system.

Apply patches available from the vendor according to the references (https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/). Until updates are applied, it is recommended to restrict network access to the vulnerable component and monitor traffic for exploitation attempts.

Nokia Wavesuite NOC — versions indicated in the vendor's references