Nokia WaveSuite NOC Command Injection Vulnerability

A command injection vulnerability has been identified in Nokia WaveSuite NOC versions WS-NOC 24.6, WS-NOC 23.6, and WS-NOC 23.12. This vulnerability allows user input to be passed unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) could exploit this issue to execute commands on the operating system under the context of the web server. The vulnerable component is bound to the network stack, potentially allowing exploitation from the entire Internet. The vulnerability can be exploited while creating a new user from the user management interface.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the operating system, under the context of the web server.

Remediation

Users can upgrade to Nokia WaveSuite NOC 24.6 FP3 or later to address this vulnerability.