CVE-2026-34485

Deferred Deferred - Pending Action

CLI ACL Bypass in Nokia 1830 Global Express

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Nokia

Description

Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-34485

EUVD

EUVD-2026-104986

Affected Vendors & Products

Vendor	Product	Version / Range
Nokia	Nokia 1830 Global Express (GX)	G42, GX G31, GX G32, GX G34 releases prior to GX r9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Nokia 1830 Global Express (GX) devices have a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism. This allows them to gain access to the underlying operating system shell by executing a custom SSH command. The issue is present by default and not due to misconfiguration.

Detection Guidance

To detect this vulnerability, check the version of your Nokia 1830 Global Express (GX) device. If it is running a version prior to GX r9.0, it is vulnerable. No specific commands are provided in the context, but monitoring for unauthorized shell access via SSH and verifying device firmware versions is recommended.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to the operating system shell of Nokia 1830 GX devices. This could lead to full control over the device, enabling data theft, system manipulation, or disruption of services. The high CVSS score of 7.8 indicates significant impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Organizations using affected Nokia devices may face legal penalties, data breach notifications, and reputational damage due to non-compliance with security standards.

Mitigation Strategies

Upgrade Nokia 1830 Global Express (GX) devices to version GX r9.0 or later to address the CLI ACL Bypass vulnerability.
Restrict SSH access to authorized users only and monitor for unusual SSH command execution.
Apply network segmentation to limit exposure of vulnerable devices to low-privileged users.

Hi! I’m here to help you understand CVE-2026-34485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...