Security readout for executives and security teams
Plain-English summary
Nokia NetAct 22 has a reported weakness in its Administration of Measurements area. A malicious user can place harmful content in a template name that later appears in exported CSV or XLSX files. Risk depends on someone downloading and opening that file, but the source states code may execute on the victim machine.
Executive priority
Treat this as a targeted operational technology support-system risk, not a broad internet worm scenario. Prioritize if Nokia NetAct 22 supports critical network operations or if many users can create templates or export measurement files.
Technical view
The reported issue involves the templateName parameter in /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf. User-controlled content can be included in generated spreadsheet exports. The source bundle provides no CVSS score, CWE, patch status, or complete affected-version metadata beyond Nokia NetAct 22.
Likely exposure
Exposure appears limited to organizations running Nokia NetAct 22 with access to the Administration of Measurements website section. The bundle’s affected-product metadata is incomplete, so inventory owners should verify NetAct version and whether these AOM pages are reachable by users.
Exploitation context
The bundle does not report active exploitation and CISA KEV is false. Exploitation appears to require a malicious user able to manipulate the templateName value and a victim who downloads and opens the generated CSV or XLSX file.
Researcher notes
The public record is sparse: no CVSS, CWE, affected CPEs, patch details, or exploitation report are included. Analysis should stay close to the described export path and avoid assuming broader NetAct components or versions are affected.
Mitigation direction
- Check Nokia vendor guidance for fixed versions or recommended mitigations.
- Restrict access to the Administration of Measurements section to trusted users.
- Review spreadsheet export handling for unsafe user-controlled values.
- Warn operators not to open unexpected NetAct exports from untrusted workflows.
- Monitor for unusual template creation or modification activity.
Validation and detection
- Inventory Nokia NetAct deployments and confirm whether version 22 is present.
- Verify whether the referenced AOM JSF pages are reachable.
- Review template records for suspicious or unexpected templateName values.
- Confirm spreadsheet exports neutralize user-controlled template names safely.
- Check vendor advisories for patch or configuration guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-28864 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlCVE reference
- https://www.gruppotim.it/it/footer/red-team.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.