Medium severity · published Sep 18, 2025
CVE-2024-25011
Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Ericsson Catalog Manager · Ericsson
through 22.6 · source: vendor
EO
Ericsson Order Care · Ericsson
through 22.6 · source: vendor