Ericsson Network Manager CVE-2025-27259

Exploitation requires the attacker to reach the Ericsson Network Manager web interface over an adjacent/management network (AV:A, not internet-wide) and to already hold low-level privileges (PR:L) - authentication is therefore required per the vendor vector. Critically, success also depends on active interaction by a victim user (UI:A), such as an authenticated operator clicking a crafted link or viewing injected content, which substantially limits realistic exploitation. Impact is confined to limited confidentiality and integrity in the victim's browser context (data exfiltration or redirection); there is no availability impact. The flaw is remediated in ENM 25.2 GA, so only deployments running versions prior to 25.2 GA are exposed.

This is a genuinely low-priority issue, and multiple independent signals agree. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) yields a base score of only 2.4 (Low): exploitation requires adjacent network access, pre-existing low-level privileges (PR:L), and active victim interaction (UI:A), with only limited confidentiality and integrity impact and no availability impact - consistent with a stored/reflected XSS flaw (CWE-79). EPSS reinforces this: 0.20% probability at the 9th percentile indicates very low likelihood of exploitation activity. The CVE is NOT on the CISA KEV list and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No signals conflict here - CVSS, EPSS, and the absence of KEV/POC all point the same direction. The one caveat is that the product itself (a telecom operator OSS platform) is a high-value target environment, so even a low-CVSS XSS could matter in a targeted intrusion chain; however, the required adjacent access plus authentication plus user interaction make opportunistic or widespread exploitation implausible. Net: a real but low-urgency bug to patch on normal cycles, not an emergency.

An attacker with low-privilege access on the adjacent management network crafts a malicious link or input that injects script into the Ericsson Network Manager web interface. When an authenticated operator views the affected page, the script executes in their browser session, allowing limited data exfiltration or redirection of the victim to an attacker-controlled domain. No public exploit code is known, and successful exploitation hinges on the victim clicking or interacting with the crafted content.