Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2021-35486 is a high-severity CSRF (CWE-352) vulnerability in Nokia Impact Mobile. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-35486 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting Nokia IMPACT through version 19.11.2.10-20210118042150283. The flaw exists in the /ui/rest-proxy/entity/import endpoint, where neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated, enabling a remote attacker to import and overwrite the entire application configuration.
A remote attacker with no required privileges (PR:N) can exploit this vulnerability by tricking an authenticated user (UI:R) into interacting with a malicious webpage, such as via a crafted link. Successful exploitation allows the attacker to fully overwrite the application's configuration, resulting in high confidentiality and integrity impacts (C:H/I:H) with no availability impact (A:N), as reflected in the CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
Advisories and mitigation guidance are provided in references including the Gruppo TIM Red Team disclosure at https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html, Nokia's IMPACT IoT platform page at https://www.nokia.com/networks/solutions/impact-iot-platform/, and Nokia's responsible disclosure notice at https://www.nokia.com/notices/responsible-disclosure/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-22128
Vulnerability Data
A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF flaw in public-facing web endpoint directly enables remote exploitation of the application to overwrite configuration.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires mechanisms to protect session authenticity such as CSRF token validation via nonces or cookies, directly mitigating the lack of validation in the vulnerable endpoint.
Mandates validation of information inputs like the X-CSRF-NONCE header or cookie at the /ui/rest-proxy/entity/import endpoint to block forged configuration import requests.
Enforces approved authorizations for access to sensitive functions like configuration import, which can incorporate request authenticity checks to prevent CSRF exploitation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.