Read the docs
TI-2024-16496 Aliases CVE-2024-25007GHSA-8f9g-693j-6rw3

Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability

Priority LOW 32CWE-1236Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed Ericsson Network Manager (Ericsson): 23.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EricssonEricsson Network Managerbefore 23.123.1Patch availableCNA
  • Ericsson Network Manager VendorEricsson Affected before 23.1 Fixed in 23.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ericsson:network_manager:*:*:*:*:*:*:*:*before 23.1VulnerableEricsson
  • cpe:2.3:a:ericsson:network_manager:*:*:*:*:*:*:*:* Versions before 23.1 Vulnerable ·Ericsson

Remediation

  • Fix · CNA Ericsson Network Manager (Ericsson) Fixed in 23.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25007
  2. 2026-10-03 Alias added: GHSA-8f9g-693j-6rw3

References

Advisory 1

  • TI-2023-20809 Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated… CVSS 3.1HIGH 8.8
  • TI-2022-22938 Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the… CVSS 3.1MEDIUM 6.8
  • TI-2021-09598 Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that… CVSS 3.1MEDIUM 6.5
  • TI-2025-20105 Ericsson Network Manager: escalation of privilege vulnerability CVSS 4.0MEDIUM 6.9
  • TI-2021-12242 In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS… CVSS 3.1MEDIUM 4.9
  • TI-2022-22937 Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the… CVSS 3.1MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences