CVE-2025-27259CWE-79cross-site-scripting

CVE-2025-27259

Medium · published October 13, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-13T11:15Z
Affected products (1)
ProductVersionsFixed in
ericsson/network_manager< 25.225.2
References (1)
https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-enm-october-2025 · 85b1779b-6ecd-4f52-bcc5-73eac4659dcf
EPSS history
Timeline
  • 13 OCT 06:16Z
    Ericsson Network Manager: improper neutralization of user controlled input
    cvelistv5