CVE-2025-24936
Insufficient Validation of Input in the URL
- State
- Published
- Severity
- 9.0 Critical
- Published
- Jul 21, 2025
- Updated
- Jul 23, 2025
- Reserved
- Jan 29, 2025
Description
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet.
An attacker with low privileged access to the application has the potential to execute commands on the operating system under the context of the webserver.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.0 Critical | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
WaveSuite NOCNokia |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.