Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-24329

OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network

Medium6.4EPSS 0.27%
Published
Updated
Reserved
Assigned by
Nokia

Description

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software utilizes libarchive APIs with security options enabled, effectively mitigating the reported path traversal issue.

Scores

CVSS scores of CVE-2025-24329, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Medium6.4CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred3.1Medium6.4CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.27% · top 81% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

Affected products

  • Nokia · Nokia Single RAN

    • affected All releases prior to 24R1-SR 1.0 MP
    • unaffected 24R1-SR 1.0 MP and later

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-24329 badge
[![CVE-2025-24329](https://trackcve.app/badge/CVE-2025-24329.svg)](https://trackcve.app/cve/CVE-2025-24329)

Record last updated .