Nokia Service Router Operating System vulnerabilities

2 CVEs affecting Nokia Service Router Operating System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6729, published 2024-10-17.

More from Nokia.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-41376, published 2023-08-29. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.
• CVE-2023-6729, published 2024-10-17. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access…