What’s Vulnerable › Vulnerabilities

CVE-2021-28488

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-10 · updated 2026-06-17
• Weakness: CWE-668

Description

Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).

Affected products

• Ericsson Network Manager(ENM): before 21.2 — fixed in 21.2

How to fix

Upgrade to a fixed version: Ericsson Network Manager(ENM) 21.2. Check the vendor advisory for mitigations.

References

• https://www.ericsson.com
• https://www.ericsson.com/en/about-us/enterprise-security/psirt
• https://www.gruppotim.it/it/footer/red-team.html
• https://www.ericsson.com
• https://www.ericsson.com/en/about-us/enterprise-security/psirt
• https://www.gruppotim.it/it/footer/red-team.html

Get alerted when CVE-2021-28488 or the next vulnerability affects your stack