Nokia Patches Critical Flaws in CloudBand and NCS: CVE-2023-49564 and CVE-2023-49565

Nokia has published a security advisory warning customers of two high-severity vulnerabilities affecting its CloudBand Infrastructure Software (CBIS) and Nokia Container Services (NCS) platforms. The flaws, CVE-2023-49564 and CVE-2023-49565, carry CVSS base scores of 9.6 and 8.4 respectively, and are described as an authentication bypass and a remote code execution bug.

According to Nokia, CVE-2023-49564 allows an unauthenticated user to gain access to API functions by sending a specially crafted HTTP header, due to poor verification in the Nginx Podman container, with a partial mitigation available by restricting access to the management network using an external firewall.

CVE-2023-49565 involves remote command execution via the /api/plugins endpoint, where improper sanitisation of headers enables arbitrary commands to be passed into a subprocess, with potential full system compromise since the service runs with root privileges.

Affected products and versions include CBIS 22 and NCS 22.12 and NCS 23.10, and Nokia has issued fixes: CBIS 22 FP1 MP1.2, NCS 22.12 MP3, and NCS 23.10 MP1, with administrators urged to upgrade immediately and restrict management network exposure during patching.