CVE-2026-34485

Not scored yetLast modified Oct 20, 2026

Description

Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-344867.5Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInteCVE-2026-344877.5Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed theCVE-2026-344887.0IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arCVE-2026-34493.3Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignaCVE-2026-344905.5Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken CVE-2026-344916.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and JohnsoCVE-2026-344927.0External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: befCVE-2026-344937.2- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affeCVE-2026-344947.2- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue CVE-2026-344955.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee aCVE-2026-344967.1Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.CVE-2026-344975.4Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows C
CVE-2026-34485: Unscored | Vulnix