Nokia ASIK AirScale System Module
Plan Patch8.4ICS-CERT ICSA-22-307-02Nov 3, 2022
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Two vulnerabilities in Nokia ASIK AirScale 5G Common System Modules (versions 474021A.101 and 474021A.102) allow local privilege escalation. Successful exploitation could result in execution of malicious kernel code or arbitrary programs running with elevated privileges. These vulnerabilities are not remotely exploitable and require local access to the affected system. No known public exploits exist, and no fix is currently available from Nokia.
What this means
What could happen
An attacker with local access to an ASIK AirScale 5G system could execute arbitrary code with elevated privileges, potentially modifying or stopping 5G network functions and services managed by the affected module.
Who's at risk
5G network operators and telecommunications service providers who operate Nokia ASIK AirScale Common System Modules. Any facility managing 5G infrastructure using affected ASIK module versions (474021A.101 and 474021A.102) is at risk from local attackers or insiders who gain shell access to the device.
How it could be exploited
An attacker must have local shell access or physical access to the ASIK AirScale system module. Once on the device, they could exploit a privilege escalation vulnerability to execute a malicious kernel or arbitrary programs with elevated privileges, compromising the integrity and availability of the 5G network infrastructure.
Prerequisites
- Local shell access or physical access to the ASIK AirScale 5G Common System Module
- Low-privilege user account on the target system
- No remote exploitation possible—attacker must be local to the device
No patch availablePrivilege escalation to kernel levelCould enable arbitrary code executionAffects telecom/5G infrastructureLow exploitation complexity once local access is gained
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (2)
2 pending
ProductAffected VersionsFix Status
ASIK AirScale 5G Common System Module: 474021A.101474021A.101No fix yet
ASIK AirScale 5G Common System Module: 474021A.102474021A.102No fix yet
Remediation & Mitigation
0/5
Do now
0/2WORKAROUNDContact Nokia support to obtain technical support notes and mitigation instructions for your specific ASIK AirScale system version
HARDENINGRestrict physical and network access to ASIK AirScale system modules to authorized personnel and engineering workstations only
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
HARDENINGImplement firewall rules to isolate 5G network infrastructure from business networks and the Internet
HARDENINGMonitor local system access logs on ASIK AirScale modules for unauthorized login attempts or privilege escalation activity
HARDENINGMaintain current VPN software and enforce VPN-only access for remote engineering or maintenance sessions to ASIK systems
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/3cfd5e59-5b0a-4010-b3e5-d037507b59da