Nokia Broadcast Message Center vulnerabilities

2 CVEs affecting Nokia Broadcast Message Center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-45899, published 2026-05-08.

More from Nokia.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-45899, published 2026-05-08. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.
• CVE-2021-35487, published 2022-05-25. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts…