STIGQter: STIG Summary: Nokia Service Router OS 25.x Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to assign appropriate user roles or access levels to authenticated users.

DISA Rule

SV-283761r1223367_rule

Vulnerability Number

V-283761

Group Title

SRG-APP-000033-NDM-000212

Rule Version

NOKI-ND-000100

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-000366 - Implement the security configuration settings.
• CCI-003980 - Allow user installation of software only with explicit privileged status.
• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
• CCI-000345 - Enforce logical access restrictions associated with changes to the system.

Weight

10

Fix Recommendation

Administrative profiles exist by default. Other profiles should be created based on user roles and access levels.

Create a new profile and add as many entries as needed:

- configure system security profile <profile name>
- default-action <deny-all or permit-all or none or read-only-all>
- entry <entry id>
- match <command string>
- action < permit or deny or read-only or none>

Apply the correct profile to each user:

- configure system security user <user name> console member <profile name>

Check Contents

For local accounts, role-based access control is configured through the user profile.

Verify the "profile" assigned to each user using the command below:

- show system security user <user name> detail
- show system security user "admin" detail | match profile
profile : administrative

In this example, user "admin" is configured with user profile "administrative".

Verify the user-assigned profile matches the user roles and responsibilities:

- show system security profile <profile name>
- show system security profile "administrative"

User Profile : administrative
Def. Action : permit-all
LI : no

NETCONF RPC

NETCONF Kill RPC Authorization : yes
NETCONF Lock RPC Authorization : yes
NETCONF Close-Session RPC Authorization : yes
NETCONF Get RPC Authorization : yes
NETCONF Get-Config RPC Authorization : yes
NETCONF Get-Data RPC Authorization : yes
NETCONF Edit-Config RPC Authorization : yes
NETCONF Copy-Config RPC Authorization : yes
NETCONF Delete-Config RPC Authorization : yes
NETCONF Discard-Changes RPC Authorization : yes
NETCONF Validate RPC Authorization : yes
NETCONF Commit RPC Authorization : yes
....

For external AAA servers, access levels are available per command. Nokia routers support TACACS+ and RADIUS authentication servers.

If the Nokia router does not enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level, this is a finding.

Vulnerability Number

V-283761

Documentable

False

Rule Version

NOKI-ND-000100

Severity Override Guidance

For local accounts, role-based access control is configured through the user profile.

Verify the "profile" assigned to each user using the command below:

- show system security user <user name> detail
- show system security user "admin" detail | match profile
profile : administrative

In this example, user "admin" is configured with user profile "administrative".

Verify the user-assigned profile matches the user roles and responsibilities:

- show system security profile <profile name>
- show system security profile "administrative"

User Profile : administrative
Def. Action : permit-all
LI : no

NETCONF RPC

NETCONF Kill RPC Authorization : yes
NETCONF Lock RPC Authorization : yes
NETCONF Close-Session RPC Authorization : yes
NETCONF Get RPC Authorization : yes
NETCONF Get-Config RPC Authorization : yes
NETCONF Get-Data RPC Authorization : yes
NETCONF Edit-Config RPC Authorization : yes
NETCONF Copy-Config RPC Authorization : yes
NETCONF Delete-Config RPC Authorization : yes
NETCONF Discard-Changes RPC Authorization : yes
NETCONF Validate RPC Authorization : yes
NETCONF Commit RPC Authorization : yes
....

For external AAA servers, access levels are available per command. Nokia routers support TACACS+ and RADIUS authentication servers.

If the Nokia router does not enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level, this is a finding.

Check Content Reference

M

Target Key

5744