CVE-2021-35486

HIGH 8.1CVE-2021-35486 · Published 03/03/2026 · updated 17/06/2026

In short

CVE-2021-35486 is a HIGH (CVSS 8.1) vulnerability affecting impact mobile (nokia).
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
impact mobile nokia	`≤ 19.11.2.10-20210118042150283`	No fix yet

Description

A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.

References

gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html · Third Party Advisory
nokia.com/networks/solutions/impact-iot-platform · Product
nokia.com/notices/responsible-disclosure · Vendor Advisory

More vulnerabilities in impact mobile

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free