CVE-2021-35485

Published: Mar 3, 2026Modified: Jun 17, 2026

8.0

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.

Affected (1)

Products: Nokia: Impact

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nokia Impact	Up to 19.11.2.10-20210118042150283

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35485.html

Source: cve@mitre.org

Vendor Advisory

https://www.nokia.com/networks/solutions/impact-iot-platform/

Source: cve@mitre.org

Product

https://www.nokia.com/notices/responsible-disclosure/

Source: cve@mitre.org

Issue Tracking

Timeline

No history available yet.