CVE-2025-10262: Nokia SR Linux Local Privilege Escalation via Format String Vulnerability

Technical summary

This vulnerability in Nokia SR Linux results from unsanitized format validation—specifically, a CWE-134 format string vulnerability. An attacker with valid credentials and local access can inject specially crafted input that bypasses format string validation, leading to arbitrary code execution with elevated privileges. The attack vector is local (AV:L), requires high privileges to initiate (PR:H), and occurs without user interaction (UI:N). The impact is significant: low confidentiality impact, high integrity impact, and high availability impact.

Business impact

Exploitation of this vulnerability could allow an insider or local attacker to gain administrative control over Nokia SR Linux devices, potentially enabling data theft, system manipulation, service disruption, or lateral movement within network infrastructure. For organizations using SR Linux in mission-critical routing or network edge deployments, unauthorized superuser access poses a severe operational and security risk. This is particularly concerning in multi-tenant or shared-access environments.

Affected systems

Nokia SR Linux is affected by this vulnerability. The source data does not specify version ranges; verify against Nokia's official advisory for precise product versions and affected releases to determine your organization's exposure.

Exploitability

This is a local privilege escalation requiring an authenticated user account and direct device access—remote exploitation is not possible. However, the low complexity (AC:L) means that once an attacker has local access and valid credentials, the exploitation process is straightforward. The requirement for high privileges (PR:H) to initiate the attack somewhat limits the immediate threat surface, but compromised administrative or operator accounts could weaponize this flaw quickly.

Remediation

Organizations should apply Nokia's security patch as soon as it becomes available and has been validated in a test environment. Until patching is complete, restrict local access to SR Linux devices to trusted personnel, review and enforce strict authentication controls, and monitor system logs for suspicious format string injection attempts or unexpected privilege escalation events.

Patch guidance

Contact Nokia or visit their security advisories portal for the specific patched version addressing CVE-2025-10262. Before deploying patches to production, validate compatibility with your network topology and running configuration. Establish a phased rollout plan for multi-device deployments to minimize operational disruption.

Detection guidance

Monitor SR Linux system logs and audit trails for failed authentication attempts, unusual format string patterns in input fields, and unexpected privilege escalation. Review access logs for unauthorized local login attempts. Implement file integrity monitoring on critical binaries to detect unauthorized modifications. Consider network segmentation to limit local access paths to SR Linux management interfaces.

Why prioritize this

Although the CVSS score of 6.3 places this in the medium-severity range, the combination of a high-privilege requirement (limiting immediate exposure) and high integrity/availability impacts warrants prompt attention. Organizations with SR Linux devices in sensitive roles or with significant local access vectors should prioritize patching. This is not a zero-day and is not tracked in the CISA KEV catalog, allowing time for measured remediation planning.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects the local-only attack vector and high-privilege requirement, which constrain the attack surface. However, the high integrity and availability impacts reflect the serious consequences of successful exploitation—superuser command execution can fully compromise device functionality and data. The low confidentiality impact suggests the flaw does not inherently leak sensitive data, but authenticated attackers with superuser access can access anything on the system post-exploitation.

Frequently asked questions