Executive brief
Nokia Broadcast Message Center (BMC) is a telecommunications messaging platform used by carriers and service providers. Versions before 13.1 contain an unauthenticated remote code execution vulnerability in the Log Scanner web interface that allows attackers to execute arbitrary operating system commands with root privileges. An attacker can exploit this flaw without authentication over the network to fully compromise the system.
Technical details
This is an OS command injection vulnerability in the Log Scanner Search Pattern field of Nokia BMC. The vulnerability stems from insufficient input validation of the search pattern parameter, which fails to sanitize shell metacharacters before passing user input to a system command. The vulnerability is exploitable via an unauthenticated HTTP request to the Log Scanner web interface; an attacker can inject shell commands using metacharacters (e.g., `;`) followed by arbitrary Linux commands in the Search Pattern field. Because the BMC service runs with root privileges, successful exploitation grants the attacker complete system compromise. The vulnerability was patched in version 13.1.
Affected products
- Nokia Broadcast Message Center before 13.1
Timeline
- 2026-05-08: disclosed: CVE-2022-45899 published
- 2023-11-29: exploited: Public exploit (EDB-51896) released demonstrating RCE on version 13