CVE-2021-32570

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-26 · updated 2026-06-17
Weakness: CWE-532

Description

In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log’s files, under a common path, and read information stored in the log’s files in order to conduct privilege escalation.

Affected products

Ericsson Network Manager(ENM): before 21.2 — fixed in 21.2

How to fix

Upgrade to a fixed version: Ericsson Network Manager(ENM) 21.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32570 or the next vulnerability affects your stack