Ericsson Network Manager CVE-2025-27258

Exploitation requires (1) adjacent-network reachability to the Ericsson Network Manager - i.e., a logically adjacent position such as the operator's management/OSS network, not the public Internet (AV:A), and (2) a valid low-privilege authenticated ENM account (PR:L). No user interaction is needed (UI:N). The flaw affects ENM versions prior to ENM 25.1 GA; upgrading to 25.1 GA removes it. Limiting factors that reduce realistic risk: the attacker must already possess credentials and adjacent network access, so this is not remotely internet-exploitable and is most relevant to insider threats or post-foothold lateral movement within a carrier's management plane.

This is a moderate-priority issue rather than an emergency. The CVSS 4.0 base score of 6.9 (Medium) is driven by an adjacent attack vector (AV:A), low attack complexity (AC:L), and a requirement for low-level privileges (PR:L) with no user interaction, yielding high confidentiality impact only (VC:H; VI/VA:N). Supporting signals all point to low real-world urgency: EPSS is just 0.30% (21st percentile), the CVE is NOT in CISA KEV, and no public exploit code or POC is referenced - so exploitation is neither confirmed nor demonstrated. The adjacency requirement plus the need for a valid low-privilege ENM account substantially narrows the realistic attacker population to insiders or those who have already gained a foothold on the management/OSS network. One notable inconsistency: the description characterizes the flaw as an 'escalation of privilege' (CWE-284, improper access control), yet the vendor-supplied CVSS vector records only confidentiality impact (VI:N, VA:N) - a privilege-escalation outcome would normally also carry integrity impact, so the scored impact profile and the described effect do not fully align and should be verified against the Ericsson bulletin. Overall: a genuine but not widespread, authenticated, adjacent-only weakness that telecom operators should patch on a normal cycle, not a drop-everything priority.

An attacker with a valid low-privilege account on the Ericsson Network Manager, positioned on the adjacent management network, sends crafted requests that abuse improper access controls to gain elevated privileges within ENM. No user interaction or victim action is required, but the attacker must first hold a foothold account and adjacent network reachability. No public exploit code is referenced, so any exploitation would currently require independent development.