Privilege escalation in Nokia Web Element Manager
CVE-2023-26062
A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network solution architecture. This means that exploit is not possible from mobile network user UEs, from roaming networks, or from the Internet. Exploitation is possible only from a CSP (Communication Service Provider) mobile network solution internal BTS management network.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (5.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
Weakness classification (CWE)
References
- nokia.com (Product)
- www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-… (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-26062?
- CVE-2023-26062 is a high-severity vulnerability in Nokia Web Element Manager, classified under Improper Privilege Management. CVSS score: 7.0/10. Published 2023-06-14.
- How severe is CVE-2023-26062?
- High severity. CVSS v3 base score is 7.0 out of 10.