The Tales of N4nj0

Nokia IMPACT - Multiple Vulnerabilities

TL;DR

During a security assessment of the Nokia IMPACT IoT platform, four distinct vulnerabilities were identified and reported. This work built directly on previous research carried out by Francesco Giordano, whose earlier findings on the product were the starting point that allowed us to investigate the platform together and discover the following new issues:

1 - Stored Cross-Site Scripting (CVE-2021-35483): An authenticated user is able to store arbitrary JavaScript that is later executed in the browser of other authenticated users.
2 - Blind SQL Injection (CVE-2021-35484): An authenticated user is able to perform a time-based boolean blind SQL Injection against the backend database.
3 - Unrestricted File Upload / Remote Code Execution (CVE-2021-35485): An authenticated user is able to upload arbitrary server-side executable files, potentially leading to remote code execution.
4 - Cross-Site Request Forgery (CVE-2021-35486): Missing validation of the anti-CSRF token allows a remote attacker to import and overwrite the entire application configuration.

Limited disclosure. This advisory intentionally omits step-by-step reproduction details, affected endpoints, parameters and proof-of-concept payloads. The intent is to document the existence, nature and impact of the issues and to give proper credit, without providing a ready-to-use exploitation guide. Readers who need further detail should refer to the official vendor and coordinator advisories linked below.

A note on the disclosure delay. These CVEs were publicly registered in 2021⁄2022, yet this write-up is only being published now — roughly five years after the discovery. The delay was not technical. At the time of the research I was bound by the decision of my past employer, under whose engagement the assessment was performed, not to publish. Now that those constraints no longer apply, and with the vendor having long since remediated the issues, I am finally able to share this account and give proper credit to everyone involved.

Product Information

Nokia IMPACT is an IoT platform used to connect, manage and collect data from large fleets of devices, with capabilities spanning device management, data collection, subscription management and application enablement.

During a security audit of the product, building on earlier research by Francesco Giordano, we identified four vulnerabilities affecting different components of the web management interface. All of the issues require authentication, but they can be chained and combined to significantly increase the impact against the platform and its users.

Credits: These findings are the result of joint research by Francesco Giordano and Veno Eivazian. Francesco’s prior work on the platform laid the groundwork, and we investigated and confirmed the new issues together.

Vulnerability Details

In line with the limited-disclosure approach, each issue is described at a high level only. Endpoints, parameters, and proof-of-concept payloads are deliberately not published.

1 - Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) - CWE-79

  • Summary: A component of Nokia IMPACT allows an authenticated user to store JavaScript content that is subsequently served to, and executed in the browser of, other authenticated users, resulting in a stored (persistent) Cross-Site Scripting.
  • Prerequisites: The attacker must be an authenticated user with access to the affected functionality.
  • CVE and CVSS Score: CVE-2021-35483 | 4.1 (Medium)

Security Impact

By exploiting this issue, an authenticated attacker can cause malicious JavaScript to execute in the browser of other authenticated users. This can be leveraged for session hijacking, credential theft, and performing unauthorized actions within the Nokia IMPACT management console on behalf of the victim.

2 - Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) - CWE-89

  • Summary: Nokia IMPACT is affected by a time-based boolean blind SQL Injection that an authenticated user can exploit to interact with the backend database, including retrieving the database user, database name, and database version information.
  • Prerequisites: The attacker must be an authenticated user with access to the affected functionality.
  • CVE and CVSS Score: CVE-2021-35484 | 8.8 (High)

Security Impact

By exploiting this issue, an authenticated attacker can extract data from the backend database — including metadata such as the database user, name and version, and potentially other stored data — compromising the confidentiality of the system.

3 - Unrestricted Upload of File with Dangerous Type - CWE-434

  • Summary: A component of Nokia IMPACT allows an authenticated user to upload server-side executable files without adequate type restrictions. Under the right conditions this can lead to remote code execution on the affected server.
  • Prerequisites: The attacker must be an authenticated user with access to the affected functionality.
  • CVE and CVSS Score: CVE-2021-35485 | 8.0 (High)

Security Impact

By exploiting this issue, an authenticated attacker can upload malicious server-side executable content, potentially achieving remote code execution and full compromise of the Nokia IMPACT server and the IoT infrastructure it manages.

4 - Cross-Site Request Forgery (CSRF) - CWE-352

  • Summary: Nokia IMPACT does not properly enforce anti-CSRF protection on a sensitive, state-changing configuration operation. As a result, a remote attacker can craft a request that, when triggered by an authenticated user, imports and overwrites the entire application configuration.
  • Prerequisites: The victim must be an authenticated user who is tricked into triggering the attacker-controlled request (e.g. by visiting a malicious page).
  • CVE and CVSS Score: CVE-2021-35486 | 8.1 (High)

Security Impact

By exploiting this issue, a remote attacker can force an authenticated user to import and overwrite the entire application configuration without their consent, compromising the integrity and availability of the platform.

Timeline

Note: the dates below are placeholders reconstructed around the public NVD registration. Replace them with the real disclosure dates before publishing.

  • 10/05/2021: Research conducted by Francesco Giordano and Veno Eivazian, building on Francesco’s previous findings on the platform.
  • 20/05/2021: Vulnerabilities reported to the vendor / coordinated through the disclosure process.
  • 21/05/2021: CVEs reserved.
  • 2021–2026: Fixes implemented by Nokia.
  • 2021–2026: Public write-up withheld due to a decision of the past employer under whose engagement the assessment was performed.
  • 22/07/2026: Constraints lifted — this limited-disclosure account is published and credits shared.