High severity · published Apr 4, 2024
CVE-2024-25007
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a…
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NM
Network Manager · Ericsson
before 23.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25007
Vendor Advisory
https://www.ericsson.com/en/about-us/security/psirt/security-bulletin--ericsson-network-manager-march-2024
More from Network Manager
9.8
CVE-2025-27258
Ericsson Network Manager: escalation of privilege vulnerability
8.8
CVE-2023-39909
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application
6.8
CVE-2022-46408
Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula…
6.5
CVE-2021-28488
Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly…
5.4
CVE-2025-27259
Ericsson Network Manager: improper neutralization of user controlled input