{"id":"CVE-2026-34485","kind":"vulnerability","aliases":["CVE-2026-34485"],"related":[],"title":"Nokia 1830 GX: low-privileged SSH user reaches the underlying OS shell","description":"Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.","summary":"Nokia 1830 Global Express (GX) has a CLI access-control bypass: a low-privileged authenticated user can escape the SSH isolation and reach the underlying operating system shell through a custom SSH command. The flaw is present by default and is not caused by misconfiguration.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nokia 1830 Global Express (GX)","fixed":["GX r9.0"],"affected":"G42, G31, G32, G34 releases prior to GX r9.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","infrastructure","network-equipment","nokia","nokia-1830-gx","ssh"],"not_affected_if":["gx-r9.0-or-later","no-low-privileged-ssh-users","no-ssh-access"],"how_to_check":"Check the installed software release on each 1830 GX (G42, G31, G32, G34); anything earlier than GX r9.0 is vulnerable. Nokia publishes no specific command; confirm via Nokia support/your release inventory. Also review which accounts have SSH access.","fix":"Upgrade Nokia 1830 GX to release GX r9.0 or later (Nokia advisory lists no workaround).","status":"open","published_at":"2026-10-20T13:16:43+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T05:04:49+00:00","updated_at":"2026-10-25T05:05:33+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T05:04:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nokia 1830 GX: low-privileged SSH user reaches the underlying OS shell","impact":"high","summary":"Nokia 1830 Global Express (GX) has a CLI access-control bypass: a low-privileged authenticated user can escape the SSH isolation and reach the underlying operating system shell through a custom SSH command. The flaw is present by default and is not caused by misconfiguration.","category":"infrastructure","nicknames":[],"who_cares":["nokia-1830-gx","network-equipment","ssh"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gets an OS shell on the network appliance","analyst_note":"Check the Nokia security advisory for affected versions and the fixed release; NVD text alone gives no version or patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-low-privileged-ssh-users"],"who_is_affected":"Operators running Nokia 1830 GX network equipment with SSH access for low-privileged accounts are exposed, since the bypass works in the default configuration. Sites without low-privileged SSH accounts on these devices face less risk. unknown for affected firmware versions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000564,"input_tokens":3338,"output_tokens":460,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the Nokia security advisory for affected versions and the fixed release; NVD text alone gives no version or patch.","search":"'-1830':32B '-2026':15A,18A '-34485':16A,19A '1830':2A,21A,36B,83C 'access':44B,110C 'access-control':43B 'acl':92C 'attack':101C 'authent':25B,51B,100C 'bypass':46B,93C,103C 'caus':79B 'cli':42B,91C 'command':69B,121C 'control':45B 'custom':67B,119C 'cve':14A,17A 'default':75B,126C 'equip':29B 'escap':54B 'express':23A,38B,85C 'flaw':71B 'gain':109C 'global':22A,37B,84C 'gx':3A,24A,33B,39B,86C 'infrastructur':26B 'isol':57B,106C 'issu':123C 'low':5A,49B,98C 'low-privileg':4A,48B,97C 'mechan':107C 'misconfigur':81B,136C 'network':28B 'network-equip':27B 'nokia':1A,20A,30B,31B,35B,82C 'occur':124C 'oper':62B,114C 'os':12A 'present':73B 'privileg':6A,50B,99C 'reach':9A,59B 'result':134C 'shell':13A,64B,116C 'ssh':7A,34B,56B,68B,105C,120C 'system':63B,115C,129C 'under':11A,61B,113C 'user':8A,52B 'via':117C 'vulner':88C,94C","nicknames":[],"mitigations":[],"who_affected":"Operators of Nokia 1830 Global Express (GX) G42, G31, G32 and G34 running a release before GX r9.0. Exploitation needs a valid low-privileged SSH login, and the flaw is present by default (not a misconfiguration), so it matters most where many users or service accounts can SSH to the device. Anyone not running these products, or already on GX r9.0+, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T05:05:33Z","by":"analyst","run_id":818},"products":{"at":"2026-10-25T05:05:33Z","by":"analyst","run_id":818},"who_affected":{"at":"2026-10-25T05:05:33Z","by":"analyst","run_id":818}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-34485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34485","severity":null,"published_at":"2026-10-20T13:16:43+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-34485:818","url":null,"severity":null,"published_at":"2026-10-25T05:05:33+00:00","modified_at":"2026-10-25T05:05:33+00:00","first_seen_at":"2026-10-25T05:05:33+00:00","fetched_at":"2026-10-25T05:05:33+00:00","note":"Read Nokia PSA directly: affected GX G42/G31/G32/G34 prior to GX r9.0, fixed in r9.0+. No exploitation or PoC found; no vendor mitigation or workaround listed. Did not search social (low-profile device)."}],"documents":[{"id":3410,"url":"https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-34485/","title":"Nokia PSA CVE-2026-34485","kind":"advisory","source":"analyst","text":"Nokia 1830 GX: CLI ACL Bypass. Low-privileged authenticated attacker bypasses SSH isolation to reach OS shell via custom SSH command; default, not misconfiguration. CVSS 3.1 AV:L/AC:L/PR:L/UI:N 7.8. Affected: GX G42, G31, G32, G34 releases prior to GX r9.0. Fix: GX r9.0 and later. Disclosed 2026-03-30.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3411,"url":"https://www.cyber.gc.ca/en/alerts-advisories/nokia-security-advisory-av26-302","title":"Cyber Centre AV26-302","kind":"other","source":"analyst","text":"Canadian Cyber Centre, 2026-03-31: Nokia published advisory 2026-03-30 for GX G42, G31, G32, G34 prior to GX r9.0; apply updates.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}