Network Manager
Monthly
Ericsson Network Manager (ENM) versions prior to 25.2 GA contain a cross-site scripting (XSS) vulnerability that can allow an authenticated attacker with access to the management network to exfiltrate limited data or redirect victims to malicious sites, but only if a victim user interacts with the crafted content. The vulnerability requires low-level privileges and user interaction, and there is no public exploit identified at time of analysis. The EPSS score is 0.20% (9th percentile), indicating a very low likelihood of exploitation.
Privilege escalation in Ericsson Network Manager (ENM) affects all releases prior to ENM 25.1 GA, allowing an attacker who already holds a valid low-privilege ENM account and can reach the system from a logically adjacent network position (for example the operator's management or OSS network) to gain high-privilege access and modify protected configuration or data. The flaw is rooted in improper access control (CWE-284) and is not reachable from the public Internet, so its practical risk is concentrated in insider abuse or post-foothold lateral movement inside a carrier's management plane; EPSS is low at 0.30 percent (21st percentile) and no public exploit code or confirmed active exploitation was identified at the time of analysis. Authentication requirements are confirmed by the provided CVSS vector, which specifies PR:L (authenticated, low privileges) and AV:A (adjacent network) with no user interaction required.
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Ericsson Network Manager (ENM) versions prior to 25.2 GA contain a cross-site scripting (XSS) vulnerability that can allow an authenticated attacker with access to the management network to exfiltrate limited data or redirect victims to malicious sites, but only if a victim user interacts with the crafted content. The vulnerability requires low-level privileges and user interaction, and there is no public exploit identified at time of analysis. The EPSS score is 0.20% (9th percentile), indicating a very low likelihood of exploitation.
Privilege escalation in Ericsson Network Manager (ENM) affects all releases prior to ENM 25.1 GA, allowing an attacker who already holds a valid low-privilege ENM account and can reach the system from a logically adjacent network position (for example the operator's management or OSS network) to gain high-privilege access and modify protected configuration or data. The flaw is rooted in improper access control (CWE-284) and is not reachable from the public Internet, so its practical risk is concentrated in insider abuse or post-foothold lateral movement inside a carrier's management plane; EPSS is low at 0.30 percent (21st percentile) and no public exploit code or confirmed active exploitation was identified at the time of analysis. Authentication requirements are confirmed by the provided CVSS vector, which specifies PR:L (authenticated, low privileges) and AV:A (adjacent network) with no user interaction required.
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.