Technical impact
The vulnerability is an OS command injection flaw that permits the execution of arbitrary shell commands with root privileges. It arises from unsanitized input in the Log Scanner Search Pattern field, allowing shell metacharacters to be interpreted by the underlying operating system. An attacker who exploits this flaw can compromise confidentiality, integrity, and availability by gaining full control of the affected device.
Affected Systems
Nokia Broadcast Message Center devices running any version prior to 13.1 are vulnerable. Users of these earlier releases should verify if they are running the affected software and plan to move to a version newer than 13.1.
Risk and Exploitability
The flaw is exploitable without authentication and requires network access to the Log Scanner interface. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would involve supplying a crafted Log Scanner Search Pattern containing shell metacharacters that the system executes with root privileges.
