Ericsson EMCLI CVE-2025-0636

Per the CVSS vector, exploitation requires: (1) adjacent-network reachability to EMCLI (AV:A) rather than open internet exposure; (2) a valid low-privilege authenticated account (PR:L); and (3) user interaction by a victim (UI:R) to process the attacker-supplied, improperly neutralized command input. The description does not name a specific feature, protocol, or configuration mode that must be enabled, so the concrete injectable parameter is not identified in available data and should be confirmed against the Ericsson advisory. Limiting factors that reduce real-world risk: the combination of required credentials, adjacent (not fully remote) positioning, and mandatory user interaction means this is not exploitable unauthenticated or hands-off at scale.

Signals point to a real but gated threat rather than an urgent mass-exploitation priority. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, 8.4 High) describes an adjacent-network attacker with low-level authentication who additionally needs victim user interaction to trigger an OS command injection (CWE-78) that crosses a security scope boundary with full confidentiality, integrity and availability loss. Those four preconditions - adjacency, valid credentials, scope change, and required interaction - materially raise the bar versus a drive-by remote RCE. The exploitation-likelihood signals agree with this gated reading: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The 'RCE'/'Command Injection' tags are technique classifications, not evidence of a POC. One point to verify with the vendor: AV:A (adjacent) is somewhat unusual for a command-line interface, where injection is often local - confirm whether EMCLI accepts input over an adjacent network path or whether local access is actually required. Overall: a genuinely high-impact flaw worth patching on affected Ericsson systems, but current real-world exploitation risk is low and conditional, not widespread.

An attacker with low-privilege EMCLI credentials on an adjacent network segment crafts input containing unneutralized OS shell metacharacters, then induces a legitimate user to perform an action that processes it, causing arbitrary commands to execute in the EMCLI context and pivot across a scope boundary. Because the scope changes (S:C), the resulting code execution can affect resources beyond the initially vulnerable component. No public exploit code is identified at time of analysis, so an attacker would need to develop the exploit themselves.