CVE-2023-25186 Explained : Impact and Mitigation

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Single RAN BTS baseband unit, a directory path traversal in the Nokia BTS baseband unit diagnostic tool AaShell (which is by default disabled) provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network.

Understanding CVE-2023-25186

This CVE identifies a vulnerability present in NOKIA Airscale ASIKA Single RAN devices that could lead to unauthorized access to the internal filesystem of the BTS baseband unit.

What is CVE-2023-25186?

The CVE-2023-25186 vulnerability exists in NOKIA Airscale ASIKA Single RAN devices before version 21B. It stems from a directory path traversal in the AaShell diagnostic tool, allowing access to the BTS baseband unit's internal filesystem.

The Impact of CVE-2023-25186

This vulnerability poses a medium risk with a base severity rating of 5.1 according to the CVSS v3.1 metrics. It could potentially lead to the compromise of confidentiality, integrity, and availability of the affected devices and network.

Technical Details of CVE-2023-25186

The following technical details outline the specific aspects of CVE-2023-25186:

Vulnerability Description

The vulnerability involves a directory path traversal within the AaShell diagnostic tool on NOKIA Airscale ASIKA Single RAN devices.

Affected Systems and Versions

The affected systems include NOKIA Airscale ASIKA Single RAN devices before version 21B.

Exploitation Mechanism

CSPs acting as BTS administrators that remove security hardenings from the NOKIA Single RAN BTS baseband unit may inadvertently enable the exploit.

Mitigation and Prevention

To address CVE-2023-25186 and enhance security measures, consider the following mitigation strategies:

Immediate Steps to Take

Ensure security hardenings are not removed from NOKIA Single RAN BTS baseband units.
Monitor and restrict access to the AaShell diagnostic tool to authorized personnel only.

Long-Term Security Practices

Implement regular security audits and assessments to identify and remediate vulnerabilities promptly.
Train BTS administrators on secure configuration practices and the importance of maintaining security protocols.

Patching and Updates

Stay informed about security advisories and updates from NOKIA regarding CVE-2023-25186. Apply patches and firmware updates as soon as they are released to mitigate the vulnerability effectively.