CVE-2023-49564 - CVE House
Back to Database
Status published Unknown CVE-2023-49564

Authentication Bypass

Vulnerability Description

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated by restricting access to the management network using external firewall.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49564

Credits & Attribution

No credits recorded in the NVD database.

References

More from Nokia

View All →
CVE-2025-9974
Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product
Unknown 0
CVE-2025-9912
A local privilege escalation vulnerability in Nokia SR Linux
Unknown 0
CVE-2025-7406
A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM
Unknown 0
CVE-2025-24938
Insufficient Validation of Input while user creation
Unknown 0
CVE-2025-24937
Access to local file system and its content
Unknown 0

Affected Vendor

Affected Software

CBIS,NCS
Vulnerable Versions:
CBIS 22, NCS 22.12

Timeline

Official Publish: September 18th, 2025
Last Modified: September 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.