CVE-2025-24818

HighCVSS 8.0/10Last modified Oct 7, 2026

Description

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Nokia	MantaRay NM	Earlier than 25R1-NM (exclusive)

References

https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24818/Vendor Advisory

Timeline

Published: Apr 7, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-248195.7Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system CVE-2025-24826.1The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all vers CVE-2025-248266.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before bui CVE-2025-248276.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-248286.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-248296.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-24836.1The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receip_address’ parameter in all CVE-2025-248306.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-248316.6Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent CVE-2025-248325.5Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis CVE-2025-248334.8Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a use CVE-2025-248346.5Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an