Nokia 1830 Global Express (GX): CLI ACL bypass grants access to OS shell
Summary
Nokia 1830 Global Express (GX) releases prior to GX r9.0 contain a CLI ACL bypass. A low-privileged authenticated user can escape the SSH command restriction via a custom SSH command and reach the underlying operating system shell. The issue exists by default and is not caused by misconfiguration, and the CNA CVSS vector (AV:L) rates it at 7.8 with high impact on confidentiality, integrity and availability.
Affected
- Nokia 1830 Global Express (GX): G42, GX G31, GX G32 and GX G34 releases prior to GX r9.0
- Releases GX r9.0 and later are not affected
Fixed in
- Upgrade to GX r9.0 or later
- Exact patch release numbers below r9.0: Unknown.
Workaround
- No vendor workaround in the sources.
- Unverified interim options (confirm with Nokia first): restrict which accounts can log in, remove unneeded low-privilege accounts, and limit management access to a jump host or management VLAN.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none known.
- CISA SSVC: exploitation none, not automatable.
- Vendor-reported exploitation: Unknown.
Our recommendation
- Plan and perform the upgrade to GX r9.0 or later.
- Review and reduce low-privilege accounts on the device now.
- Restrict SSH management access to trusted networks and jump hosts.
- Monitor logins and shell activity on affected devices.
- Check whether the vendor's attack vector assessment (local versus remote, as disputed in sources) changes your exposure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Nokia product security advisory CVE-2026-34485 www.nokia.com
- Nokia product security advisory index www.nokia.com
- OpenCVE CVE-2026-34485 app.opencve.io
- VulDB CVE-2026-34485 vuldb.com
- Strix CVE-2026-34485 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:34.
Original description (NVD)
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.