Is CVE-2022-45899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-45899 being exploited in the wild.

How severe is CVE-2022-45899?

Medium severity, with a CVSS score of 6.5, published 8 May 2026.

Which products and versions are affected?

Nokia Broadcast Message Center before 13.1.

Is there a fix for CVE-2022-45899?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-45899 attacked?

It is attacked over the network.

Am I affected by CVE-2022-45899?

Check whether you run Nokia Broadcast Message Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-45899: Nokia Broadcast Message Center OS command injection via Log Scanner

CVE-2022-45899 · Severity: medium · CVSS 6.5 · Published 2026-05-08

Nokia Broadcast Message Center (BMC) is a telecommunications messaging platform used by carriers and service providers. Versions before 13.1 contain an unauthenticated remote code execution vulnerability in the Log Scanner web interface that allows attackers to execute arbitrary operating system commands with root privileges. An attacker can exploit this flaw without authentication over the network to fully compromise the system.

Vendors: Nokia.

Quick answers

Is CVE-2022-45899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-45899 being exploited in the wild.
How severe is CVE-2022-45899?: Medium severity, with a CVSS score of 6.5, published 8 May 2026.
Which products and versions are affected?: Nokia Broadcast Message Center before 13.1.
Is there a fix for CVE-2022-45899?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-45899 attacked?: It is attacked over the network.
Am I affected by CVE-2022-45899?: Check whether you run Nokia Broadcast Message Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an OS command injection vulnerability in the Log Scanner Search Pattern field of Nokia BMC. The vulnerability stems from insufficient input validation of the search pattern parameter, which fails to sanitize shell metacharacters before passing user input to a system command. The vulnerability is exploitable via an unauthenticated HTTP request to the Log Scanner web interface; an attacker can inject shell commands using metacharacters (e.g., `;`) followed by arbitrary Linux commands in the Search Pattern field. Because the BMC service runs with root privileges, successful exploitation grants the attacker complete system compromise. The vulnerability was patched in version 13.1.

Affected products

Nokia Broadcast Message Center before 13.1

Timeline

2026-05-08: disclosed: CVE-2022-45899 published
2023-11-29: exploited: Public exploit (EDB-51896) released demonstrating RCE on version 13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.