CVE-2021-28488: Ericsson Network Manager

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).

Affected products

• Ericsson Network Manager: before 21.2 (fixed in 21.2)

Published 2022-03-10. Last modified 2026-06-17.