CVE-2025-24937
Critical
Description
File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server.
SeverityCritical
CVSS9.0
Exploit probability—
ProductNokia Wavesuite Noc
PublishedJul 21, 2025
First seenJul 21, 2025
Weakness typeCWE-98CWE-98
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokia wavesuite_noc | 23.6, 23.12, 24.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.