TI-2025-00536 Aliases CVE-2025-0636 GHSA-w279-p4m3-85cc

Arbitrary Code Execution vulnerability in Ericsson RAN Compute and Site Controller

LOW 38CWE-78Published 2025-10-13 · Updated 2025-10-14

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix Fixed Site Controller 6610 (Ericsson): S24.Q2RAN Compute (all BB versions) (Ericsson): 24.Q1.C5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ericsson	Site Controller 6610	before S24.Q2	S24.Q2	Patch available	CNA
Ericsson	RAN Compute (all BB versions)	before 24.Q1.C5	24.Q1.C5	Patch available	CNA

Site Controller 6610 VendorEricsson Affected before S24.Q2 Fixed in S24.Q2 Patch available CNA
RAN Compute (all BB versions) VendorEricsson Affected before 24.Q1.C5 Fixed in 24.Q1.C5 Patch available CNA

Remediation

Fix · CNA Site Controller 6610 (Ericsson) Fixed in S24.Q2
Fix · CNA RAN Compute (all BB versions) (Ericsson) Fixed in 24.Q1.C5

Timeline

2026-10-02 Threatist record created from CVE-2025-0636
2026-10-03 Alias added: GHSA-w279-p4m3-85cc

References

Other 1

https://www.ericsson.com/en/about-us/security/psirt/cve-2025-0636

TI-2024-09344 Authentication bypass in Ericsson CodeChecker CVSS 3.1CRITICAL 10.0
TI-2024-36027 Cross-Site Request Forgery in CodeChecker API CVSS 3.1HIGH 8.2
TI-2025-27277 Buffer overflow in CodeChecker log command CVSS 3.1HIGH 7.8
TI-2023-27200 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` CVSS 3.1MEDIUM 6.5
TI-2026-41851 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun CVSS 4.0MEDIUM 5.5
TI-2021-19324 In Ericsson Network Location before 2021-07-31, it is possible for an authenticated… CVSS 3.1HIGH 8.8

See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences