Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

The Nokia Broadcast Message Center (BMC) Log Scanner web application has a critical vulnerability that allows an unauthenticated remote attacker to perform OS command injection as the root user.

This happens because the application does not properly validate input in the Search Pattern field, allowing attackers to inject shell metacharacters and execute arbitrary commands on the server.

For example, an attacker could inject commands like ";id" or ";cat /etc/shadow" to execute system commands with root privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to execute arbitrary commands on the affected system with root privileges without any authentication.

An attacker could gain full control over the system, access sensitive data, modify or delete files, disrupt services, or use the compromised system as a foothold to attack other parts of the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the Nokia Broadcast Message Center Log Scanner web application for command injection in the Search Pattern field.

An example command to test for this vulnerability is to inject shell metacharacters such as ";id" or ";cat /etc/shadow" into the Search Pattern field and observe if the commands are executed.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Nokia Broadcast Message Center application to version 13.1 or later, where this vulnerability has been fixed.

Useful 0 Not Useful 0