CVE-2025-24816 is an improper access control vulnerability (CWE-284) in Nokia MantaRay NM's API. Due to insufficient authorization checks, an authenticated attacker can retrieve confidential information beyond their assigned privileges. The vulnerability affects all versions before 25R2-NM. There is no indication of a vendor-provided patch or official remediation at this time. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation allows an authenticated attacker to access sensitive information that should be restricted, potentially leading to data confidentiality breaches. There is no impact on system integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API to trusted users only and monitor for unauthorized access attempts. Follow Nokia's official communications for updates on patches or mitigations.