CVE-2025-0980 identifies a critical authentication bypass vulnerability in Nokia SR Linux, a network operating system used primarily in routing and switching infrastructure. The flaw resides in the JSON-RPC service, which is designed to allow remote procedure calls via JSON messages. Due to invalid validation logic, the service permits access without requiring valid authentication credentials, effectively allowing unauthorized users to interact with the system's management interface. The affected versions are all releases prior to 23.10.6 and 24.10.2, indicating that the issue was addressed in these updates. The vulnerability is classified under CWE-284 (Improper Access Control), highlighting a failure to enforce proper authentication checks. The CVSS v3.1 score of 6.4 reflects a medium severity rating, with the vector indicating that exploitation requires local access (AV:L), high attack complexity (AC:H), and high privileges (PR:H), but no user interaction (UI:N). The impact on confidentiality, integrity, and availability is high, meaning successful exploitation could lead to full compromise of the device's management functions. Although no exploits have been reported in the wild, the potential for unauthorized control over critical network infrastructure poses a significant risk. The vulnerability's presence in a core network OS used by telecom operators and enterprises underscores the importance of timely remediation.

For European organizations, especially telecommunications providers and large enterprises relying on Nokia SR Linux for network routing and switching, this vulnerability could lead to unauthorized access to critical network management interfaces. Exploitation could allow attackers to manipulate routing configurations, intercept or redirect traffic, or disrupt network availability, severely impacting business operations and service continuity. Confidential data traversing these networks could be exposed or altered, undermining data privacy and regulatory compliance such as GDPR. The requirement for local access and high privileges somewhat limits remote exploitation but insider threats or lateral movement by attackers within the network could leverage this flaw. The absence of known exploits reduces immediate risk but does not eliminate the threat, as attackers may develop exploits once the vulnerability details are widely known. Disruption of telecommunications infrastructure in key European markets could have cascading effects on other critical sectors dependent on network availability.

Organizations should prioritize upgrading Nokia SR Linux installations to versions 23.10.6 or 24.10.2 and later, where the vulnerability has been addressed. Until patches are applied, restrict access to the JSON-RPC service by implementing strict network segmentation and firewall rules to limit connections only to trusted management hosts. Employ strong access controls and monitoring on devices running SR Linux to detect any unauthorized access attempts. Conduct regular audits of network device configurations and access logs to identify suspicious activity. Additionally, implement multi-factor authentication and role-based access controls for network management interfaces to reduce the risk of privilege escalation. Consider deploying intrusion detection systems capable of recognizing anomalous JSON-RPC traffic patterns. Finally, maintain an incident response plan tailored to network infrastructure compromise scenarios to ensure rapid containment if exploitation occurs.