The vulnerability allows a low‑privileged authenticated user to bypass the CLI access‑control list and execute a custom SSH command that grants a shell on the underlying operating system. This results in unauthorized command execution and potential full system compromise. The weakness is rooted in inadequate enforcement of ACL rules and is classified by CWE‑284, improper access control.

The affected product is Nokia 1830 Global Express (GX). No specific version information is disclosed, but the issue is present by default in the system and is not a result of misconfiguration.

The exploit can be conducted remotely over the standard SSH channel. Because the attack requires only authenticated access with low privileges, many devices may be vulnerable. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 7.8, indicating high severity. The attack vector is inferred to be remote via SSH, leveraging a custom command that bypasses the isolation mechanism.