Executive Summary

CVE-2025-10262 is a local privilege escalation vulnerability in Nokia SR Linux caused by unsanitized format validation. This means that the software does not properly check or clean certain input formats, which can be exploited by an authenticated user.

Successful exploitation allows the attacker to execute arbitrary commands with superuser (root) privileges, giving them full control over the affected system.

The vulnerability affects all SR Linux versions prior to 23.10.8, 24.10.6, and 25.7.2, and impacts hardware platforms including 7215 IXS, 7220 IXR, 7250 IXR, and 7730 SXR.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows an authenticated user to escalate their privileges to superuser level.

• An attacker with lower-level access could gain full control over the system.
• They could execute arbitrary commands, potentially leading to data theft, system disruption, or further compromise.
• It could affect the integrity, confidentiality, and availability of the affected systems.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying the version of Nokia SR Linux running on your systems, as the vulnerability affects all SR Linux versions prior to 23.10.8, 24.10.6, and 25.7.2.

You can check the SR Linux version by running the following command on the device:

• show version

If the version is older than the fixed versions mentioned, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade your Nokia SR Linux devices to one of the fixed versions: 23.10.8, 24.10.6, 25.7.2, or later.

Ensure that only authenticated and authorized users have access to the system to reduce the risk of exploitation.

Monitor for any unusual activity that could indicate attempts to exploit this local privilege escalation vulnerability.

Useful 0 Not Useful 0