CVE-2025-24817 identifies an OS command injection vulnerability in Nokia MantaRay NM's Symptom Collector application. The issue arises from improper neutralization of special characters used in OS commands, allowing an attacker with low privileges and no user interaction to execute arbitrary commands remotely. The vulnerability affects all versions prior to 25R1-NM. The CVSS vector indicates the attack requires adjacent network access, low attack complexity, and low privileges, but no user interaction. The impact includes high confidentiality, integrity, and availability consequences. No patch or official remediation level has been disclosed by Nokia as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the device. The vulnerability requires adjacent network access and low privileges, increasing the risk in environments where attackers have network proximity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected Symptom Collector application to trusted users only and monitor for unusual activity related to command execution. Avoid exposing the vulnerable component to untrusted networks.