CVE-2025-7406

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-7406/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-30 10:16

Updated : 2026-07-10 17:17

NVD link : CVE-2025-7406

Mitre link : CVE-2025-7406

CVE.ORG link : CVE-2025-7406

JSON object : View

Products Affected

nokia

mantaray_nm

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2025-7406", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7406", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T13:31:19.958711Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "b48c3b8f-639e-4c16-8725-497bc411dad0", "affectedData": [{"vendor": "Nokia", "product": "MantaRay NM", "versions": [{"status": "affected", "version": "<NM 25R1-NM"}, {"status": "unaffected", "version": "\u2265NM 25R1-NM"}]}]}], "published": "2026-06-30T10:16:33.720", "references": [{"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-7406/", "tags": ["Vendor Advisory"], "source": "b48c3b8f-639e-4c16-8725-497bc411dad0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts."}], "lastModified": "2026-07-10T17:17:29.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nokia:mantaray_nm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B6443BC-E253-42E1-83CD-E681CBE3F6BE", "versionEndExcluding": "25R2-NM"}], "operator": "OR"}]}], "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0"}