CVE-2025-24328 - OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network

Back Back to CVE browser

MEDIUM

OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network

Published Jul 2, 2025

4.2

MEDIUM

CVSS 3.1

EPSS 0.20%

Description

Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later.

The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.

Affected products

Vendor Nokia Product Nokia Single RAN Default
unknown
Affected
- All releases prior to 24R1-SR 1.0 MP are affected.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Nokia	Nokia Single RAN	unknown	Affected All releases prior to 24R1-SR 1.0 MP are affected.

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-121

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19693		Advisory
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24328/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Nokia

Published Jul 2, 2025

Updated Jul 2, 2025

Reserved Jan 20, 2025

Link CVE-2025-24328

CISA Vulnrichment

Updated Jul 2, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-24328

Red Hat

No data

ENISA EUVD

Assigner Nokia

Published Jul 2, 2025

Updated Jul 2, 2025

Link EUVD-2025-19693

GitHub

No data