Low severity · published Jul 2, 2025
CVE-2025-24335
SOAP message input validation fault could in theory cause OAM service resource exhaustion
2.0
CVSS
0.5%
EPSS
No
On KEV
Description
Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service.
No practical exploit has been detected for this flaw. However, the issue has been corrected starting from release 24R1-SR 2.1 MP by adding sufficient input validation for received SOAP requests, effectively mitigating the reported issue.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Adjacent
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Nokia Single RAN · Nokia
All the releases prior to 24R1-SR 2.1 MP · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24335
www.nokia.com
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24335/
More from Nokia Single RAN
6.4
CVE-2025-24333
Administrative user shell input validation fault
6.4
CVE-2025-24331
Nokia Single RAN baseband OAM service extensive capabilities
6.4
CVE-2025-24330
OAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management network
6.4
CVE-2025-24329
OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network
4.2
CVE-2025-24328
OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network