---
id: "CVE-2026-34485"
kind: "vulnerability"
aliases: ["CVE-2026-34485"]
title: "Nokia 1830 GX: low-privileged SSH user reaches the underlying OS shell"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nokia 1830 Global Express (GX)", "fixed": ["GX r9.0"], "affected": "G42, G31, G32, G34 releases prior to GX r9.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "infrastructure", "network-equipment", "nokia", "nokia-1830-gx", "ssh"]
not_affected_if: ["gx-r9.0-or-later", "no-low-privileged-ssh-users", "no-ssh-access"]
published_at: "2026-10-20T13:16:43+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T05:05:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34485", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T05:05:33+00:00"}]
---

# Nokia 1830 GX: low-privileged SSH user reaches the underlying OS shell

Nokia 1830 Global Express (GX) has a CLI access-control bypass: a low-privileged authenticated user can escape the SSH isolation and reach the underlying operating system shell through a custom SSH command. The flaw is present by default and is not caused by misconfiguration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nokia 1830 Global Express (GX) affected G42, G31, G32, G34 releases prior to GX r9.0 fixed GX r9.0

## How to check

Check the installed software release on each 1830 GX (G42, G31, G32, G34); anything earlier than GX r9.0 is vulnerable. Nokia publishes no specific command; confirm via Nokia support/your release inventory. Also review which accounts have SSH access.

## Fix

Upgrade Nokia 1830 GX to release GX r9.0 or later (Nokia advisory lists no workaround).

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-34485
- 2026-10-25T05:05:33+00:00 analyst — Read Nokia PSA directly: affected GX G42/G31/G32/G34 prior to GX r9.0, fixed in r9.0+. No exploitation or PoC found; no vendor mitigation or workaround listed. Did not search social (low-profile device).

## Documents

- [advisory] Nokia PSA CVE-2026-34485 https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-34485/
- [mentions] Cyber Centre AV26-302 https://www.cyber.gc.ca/en/alerts-advisories/nokia-security-advisory-av26-302

## From the sources

Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_