CVE-2022-2482

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary code execution in the bootloader.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1274

Affected software

Vendor	Product	Versions
Nokia	ASIK AirScale	474021A.101; 474021A.102

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02Third Party Advisory, US Government Resource

Timeline

Published: Jan 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248205.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to v CVE-2022-248218.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a mod CVE-2022-248235.5Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4 CVE-2022-248245.3Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not CVE-2022-248255.3Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forge CVE-2022-248267.8On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found CVE-2022-248278.1Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: E CVE-2022-248288.8Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can h CVE-2022-248299.8Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require aut CVE-2022-24837.1The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification s CVE-2022-248309.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.