CVE-2021-28485: Ericsson Mobile Switching Center Server Bc 18a Firmware

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application.

Affected products

• Ericsson Mobile Switching Center Server Bc 18a Firmware: from is_3.1, before is_3.1_cp22 (fixed in is_3.1_cp22)

Published 2023-09-14. Last modified 2026-06-17.