CVE-2024-25007 Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability

What is CVE-2024-25007?

CVE-2024-25007 is a high-severity code injection vulnerability in Ericsson Network Manager, published on 4 Apr 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.

Weakness: CWE-1236

Which versions are affected by CVE-2024-25007?

It affects 1 product.

Products include Ericsson Network Manager.

How do I fix CVE-2024-25007?

No fix has been published for CVE-2024-25007 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-25007 being exploited?

There is no known exploitation of CVE-2024-25007 in the wild and no public exploit code.

Other vulnerabilities in Ericsson Network Manager

• CVE-2023-39909 Missing authorization in n/a High 8.8
• CVE-2025-27258 Ericsson Network Manager: escalation of privilege vulnerability Medium 6.9
• CVE-2022-46408 Code injection in n/a Medium 6.8
• CVE-2021-28488 Missing authorization in n/a Medium 6.5
• CVE-2021-32570 Information disclosure in n/a Medium 4.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8f9g-693j-6rw3.