What is CVE-2023-49564?

CVE-2023-49564 is a high-severity vulnerability in Nokia Cbis,ncs, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.8/10. Published 2025-09-18.

How severe is CVE-2023-49564?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2023-49564 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Nokia Cbis,ncs

CVE-2023-49564

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated by restricting access to the management network using external firewall.

EPSS: 0.004 (34.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nokia Cbis,ncs — versions CBIS 22, NCS 22.12

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

Public proof-of-concept exploits

References

b48c3b8f-639e-4c16-8725-497bc411dad0

Frequently asked questions

What is CVE-2023-49564?: CVE-2023-49564 is a high-severity vulnerability in Nokia Cbis,ncs, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.8/10. Published 2025-09-18.
How severe is CVE-2023-49564?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2023-49564 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.