Summary:
Ericsson has released two separate updates which address two security vulnerabilities found in Ericsson Network Manager (ENM).
Vulnerability description:
This section summarizes the vulnerability issue and potential impact that this security update addresses.
CVE-2025-27258 – Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege.
CVSS Base Score : 6.9
Severity: Medium
CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness Type: CWE-284: Improper Access Control
CVE-2025-27259 – Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.
CVSS Base Score : 2.4
Severity: Low
CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness Type: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Security update:
The following table lists the Ericsson products affected, versions affected, and the updated version that includes this security update.
To protect your system, download and install the updated version.
| CVE Addressed | Product Name | Affected Released Versions | Updated Release Version |
|---|---|---|---|
| CVE-2025-27258 | Ericsson Network Manager | All versions prior to 25.1 | Version 25.1 or later |
| CVE-2025-27259 | Ericsson Network Manager | All versions prior to 25.2 | Version 25.2 or later |
Mitigations:
See the solutions above for the versions to install.
Acknowledgement:
Ericsson would like to thank the following personnel from TIM Security Red Team Research for reporting these issues to us.
• Andrea Carlo Maria Dattola
• Cristina Coppola
• Carlo Pannullo
• Massimiliano Brolli
Additional information:
- Ericsson severity assessment of a vulnerability is based on an average of risk across a diverse set of installed systems and may not represent the true risk to your organization. We recommend evaluating the risk to your specific configuration.
- If you have any questions regarding this bulletin, please reach out to your local Ericsson support representative, for more information see our Customer Support page.
- Learn more about the vulnerability management process followed by the Ericsson Product Security Incident Response Team (PSIRT), see Ericsson PSIRT page.
Revision history:
| Revision | Date | Description |
|---|---|---|
| 1.0 | October 13, 2025 | Initial Release |
© Ericsson AB 2025. All rights reserved. No part of this message may be reproduced in any form without the written permission of the copyright owner. The contents of this document are subject to revision without notice due to continued progress in methodology, design and manufacturing. Ericsson shall have no liability for any error or damage of any kind resulting from the use of this message. For questions, please contact Ericsson Local Support or connect with us on the Omni Network Channel section of My Ericsson. Visit us at Support User Preferences to unsubscribe.