Ericsson
55 CVEs across 31 Ericsson products. Browse Ericsson vulnerabilities, severities, and proof-of-concept exploits.
Ericsson products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59181 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attack… | |
CVE-2025-59180 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the c… | |
CVE-2025-59178 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allo… | |
CVE-2025-59177 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically… | |
CVE-2025-59172 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execu… | |
CVE-2025-59174 | Medium | 6.5 | 2026-06-05 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may… |
CVE-2026-25659 | Medium | 6.5 | 2026-06-05 | Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously… |
CVE-2026-25658 | Medium | 6.5 | 2026-06-05 | Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously… |
CVE-2026-25657 | Medium | 6.5 | 2026-06-05 | Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability where an atta… |
CVE-2026-25660 | Critical | 9.8 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the U… |
CVE-2024-53828 | Medium | 5.3 | 2026-04-01 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may… |
CVE-2025-40842 | Medium | 6.1 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to unauthorized disclo… |
CVE-2025-40841 | Medium | 4.3 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized… |
CVE-2025-27260 | High | 7.5 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauth… |
CVE-2025-40843 | Medium | 5.9 | 2025-10-28 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 c… |
CVE-2025-27259 | Medium | 5.4 | 2025-10-13 | Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sit… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-0636 | High | 8.4 | 2025-10-13 | EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Co… |
CVE-2025-40838 | High | 7.5 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disc… |
CVE-2025-40837 | High | 8.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges… |
CVE-2025-40836 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated pr… |
CVE-2025-27262 | High | 7.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges. |
CVE-2025-27261 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data. |
CVE-2024-25011 | Medium | 5.3 | 2025-09-18 | Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the i… |
CVE-2024-25010 | High | 8.8 | 2025-05-22 | Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validation could be exploit… |
CVE-2024-53827 | High | 7.5 | 2025-05-16 | Ericsson Packet Core Controller (PCC) contains a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degrada… |
CVE-2025-1300 | Medium | 6.1 | 2025-02-28 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an… |
CVE-2024-53829 | High | 8.2 | 2025-01-21 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an un… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows… |
CVE-2024-10081 | Critical | 10.0 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the A… |
CVE-2024-25009 | Medium | 6.5 | 2024-08-20 | Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to den… |
CVE-2024-25008 | Medium | 6.8 | 2024-08-16 | Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code executi… |
CVE-2023-49793 | Medium | 6.5 | 2024-06-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoin… |
CVE-2024-25007 | High | 7.1 | 2024-04-04 | Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Fo… |
CVE-2023-39909 | High | 8.8 | 2023-12-07 | Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. |
CVE-2022-47531 | High | 8.8 | 2023-12-05 | An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI… |
CVE-2021-28485 | Medium | 4.3 | 2023-09-14 | In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the h… |
CVE-2022-46408 | Medium | 6.8 | 2023-06-29 | Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutraliz… |
CVE-2022-46407 | Medium | 4.8 | 2023-06-29 | Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection c… |
CVE-2021-32570 | Medium | 4.9 | 2022-08-26 | In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All… |
CVE-2021-28488 | Medium | 6.5 | 2022-03-10 | Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already g… |
CVE-2021-44217 | Medium | 6.1 | 2022-01-18 | In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attacke… |
CVE-2021-43339 | High | 8.8 | 2021-11-03 | In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For… |
CVE-2021-32571 | Medium | 4.9 | 2021-10-14 | In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undelet… |
CVE-2021-32569 | Medium | 6.1 | 2021-10-14 | In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is comple… |
CVE-2021-41391 | Medium | 5.4 | 2021-09-17 | In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leadi… |
CVE-2021-41390 | High | 8.0 | 2021-09-17 | In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection. |
CVE-2020-29145 | Medium | 5.4 | 2020-11-27 | In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a s… |
CVE-2020-29144 | Medium | 5.4 | 2020-11-27 | In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most te… |
CVE-2019-7417 | Medium | 6.1 | 2019-03-21 | XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id… |
CVE-2015-2167 | | 2015-04-06 | Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users… | |
CVE-2015-2166 | | 2015-04-06 | Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read… | |
CVE-2015-2165 | | 2015-04-06 | Multiple cross-site scripting (XSS) vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4.x, 5.x, and 6.x allow remo… | |
CVE-2003-1442 | | 2003-12-31 | The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access from the LAN… | |
CVE-2000-0542 | | 2000-06-13 | Tigris remote access server before 11.5.4.22 does not properly record Radius accounting information when a user fails the initial login authentication but subs… |