CVE-2025-7406: Nokia MantaRay NM Privilege Escalation

CVE-2025-7406 Overview

CVE-2025-7406 is a local privilege escalation vulnerability in Nokia MantaRay Network Manager (NM). A local attacker holding administrative (local admin) privileges can abuse the sudo configuration to escalate to full root on the host. Successful exploitation grants root-level filesystem access and the ability to execute arbitrary actions as root.

The flaw is tracked under CWE-269: Improper Privilege Management. Nokia has published a security advisory acknowledging the issue and recommends restricting the set of commands permitted via sudo for the affected accounts as a temporary mitigation.

Critical Impact
An authenticated local admin can obtain full root privileges on MantaRay NM hosts, compromising confidentiality, integrity, and availability of the network management system.

Affected Products

Nokia MantaRay Network Manager (NM)
Refer to the Nokia Security Advisory CVE-2025-7406 for version-specific details
Underlying host operating system where MantaRay NM is deployed

Discovery Timeline

2026-06-30 - CVE-2025-7406 published to the National Vulnerability Database
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-7406

Vulnerability Analysis

The vulnerability resides in how Nokia MantaRay NM configures sudo for its administrative accounts. The permitted sudo command set is overly permissive, allowing local admin users to invoke commands that can be leveraged to spawn a root shell or execute arbitrary binaries as root.

Because the attack requires local access and existing administrative credentials, exploitation is limited to insiders or attackers who have already compromised an admin account. Once escalated, the attacker holds unrestricted control over the MantaRay NM host, including access to network management data, credentials, and telemetry pipelines.

Root Cause

The underlying weakness is improper privilege management ([CWE-269]). The sudoers policy shipped with MantaRay NM grants local admin accounts the right to execute commands that were not intended as privilege boundaries. Utilities included in the sudo whitelist expose shell escapes, arbitrary file writes, or execution of user-controlled scripts, breaking the least-privilege boundary between the admin role and root.

Attack Vector

Exploitation requires local authenticated access with the admin role. The attacker invokes a permitted sudo entry that supports a shell escape or arbitrary command execution primitive. The escape yields a process running with uid=0, granting root filesystem access and process control. No user interaction and no network access are needed once the attacker is authenticated at the host.

No public proof-of-concept exploit code is available at this time. See the Nokia Security Advisory CVE-2025-7406 for vendor technical details.

Detection Methods for CVE-2025-7406

Indicators of Compromise

Unexpected sudo invocations by admin accounts targeting binaries known to allow shell escapes (for example editors, interpreters, or archive tools) recorded in /var/log/auth.log or /var/log/secure.
Processes with uid=0 parented by an admin user session shell.
Creation or modification of files under /etc, /root, or SUID binaries following a sudo event by an admin account.
New cron entries, systemd units, or SSH authorized_keys written to root-owned locations after an admin login.

Detection Strategies

Audit sudoers policy on MantaRay NM hosts and enumerate every command reachable by admin accounts; flag entries that permit interpreters, editors, or wildcards.
Enable Linux auditd rules on execve for admin UIDs and alert on transitions from admin UID to uid=0 that are not tied to approved maintenance windows.
Correlate sudo command execution logs with subsequent privileged file writes to catch privilege escalation chains.

Monitoring Recommendations

Forward auth.log, secure, and auditd events from MantaRay NM hosts to a centralized log platform for retention and correlation.
Baseline normal sudo usage per admin account and alert on deviations, particularly first-time use of shell-capable binaries.
Monitor for creation of new local accounts, SSH keys, or persistence artifacts on MantaRay NM servers.

How to Mitigate CVE-2025-7406

Immediate Actions Required

Apply the fix and guidance published in the Nokia Security Advisory CVE-2025-7406 as soon as it is available in your environment.
Inventory all MantaRay NM hosts and identify every account granted sudo rights.
Rotate credentials for any admin account that may have been misused, and review recent sudo activity for signs of exploitation.
Restrict local admin account membership to the minimum set of operators who require it.

Patch Information

Nokia has published fix guidance in the vendor advisory. Refer to the Nokia Security Advisory CVE-2025-7406 for the corrected sudoers configuration and any product updates. Apply vendor-provided remediation on all MantaRay NM installations, including standby and disaster-recovery nodes.

Workarounds

Restrict the sudo command set permitted to MantaRay NM admin accounts to only those explicitly required for operations, removing any entries that allow shell escapes or arbitrary interpreters.
Require NOPASSWD removal and enforce password prompts to add friction and improve auditability of privileged actions.
Enable command logging (log_input, log_output) in sudoers for admin accounts to increase forensic visibility.
Isolate MantaRay NM hosts on a management network and restrict interactive shell access to jump hosts with strong authentication.

bash

# Example hardened sudoers entry - restrict admin to explicit, non-shell commands
# /etc/sudoers.d/mantaray-admin
Cmnd_Alias MANTARAY_OPS = /usr/local/mantaray/bin/service-restart, \
                          /usr/local/mantaray/bin/collect-diag

%mantaray-admin ALL=(root) MANTARAY_OPS
Defaults:%mantaray-admin log_input, log_output, !authenticate=false