CVE-2021-32570 Information disclosure in n/a
Privileged AMOS users can read sensitive log files to escalate privileges in Ericsson Network Manager.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32570?
CVE-2021-32570 is a medium-severity vulnerability in n/a, published on 25 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log’s files, under a common path, and read information stored in the log’s files in order to conduct privilege escalation.
Weakness: CWE-532
Which versions are affected by CVE-2021-32570?
It affects 1 product.
Products include Ericsson Network Manager.
How do I fix CVE-2021-32570?
No fix has been published for CVE-2021-32570 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32570 being exploited?
There is no known exploitation of CVE-2021-32570 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-39909 Missing authorization in n/a
- CVE-2024-25007 Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability
- CVE-2025-27258 Ericsson Network Manager: escalation of privilege vulnerability
- CVE-2022-46408 Code injection in n/a
- CVE-2021-28488 Missing authorization in n/a
Sources
Also known as GHSA-6p27-mjwr-wc88.