Local Sudo Privilege Escalation in Nokia MantaRay NM

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted via sudo for the affected accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-7406 represents a critical privilege escalation vulnerability in Nokia MantaRay NM that allows local administrators to elevate their access to full root privileges. This vulnerability is particularly concerning because it requires only local admin access as a starting point—a common foothold for insider threats or compromised administrative accounts. Organizations running MantaRay NM for network management are directly affected, especially those relying on sudo configurations to implement least-privilege access controls. With a CVSS score of 7.8 and successful exploitation leading to unrestricted root-level filesystem access, this vulnerability can enable attackers to disable security controls, modify system configurations, and maintain persistent access across the infrastructure.

Casky's 224 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this privilege escalation (MITRE TA0004: Privilege Escalation). Practitioners using Casky would identify detection signals including: unauthorized sudo command execution patterns where local admins invoke unintended system binaries, anomalous privilege transitions from administrative to root context without corresponding business justification, and suspicious modifications to sudoers files or sudo-related logs. The platform's skills help correlate behavioral indicators such as exploitation attempts targeting known sudo parsing weaknesses, detection of shell spawning from privileged sudo processes, and reconnaissance activities probing sudo permissions post-compromise. By mapping these observations against the CWE-269 (Improper Access Control) classification, practitioners gain visibility into whether their sudo configurations inadvertently permit escalation paths and can implement compensating controls by immediately restricting permitted command sets for vulnerable accounts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-7406.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2025-7406

Casky has 224 skills that investigate the attack patterns behind CVE-2025-7406. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn