Ericsson's vulnerability profile centers on a focused portfolio of network management, service delivery, and software analysis products that serve telecommunications and enterprise infrastructure environments. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a moderate tendency toward public exploit availability. The exposure recurs across products such as CodeChecker, the Indoor Connect platform and its firmware, Network Manager, and the DRUTT mobile service delivery platform, and clusters around web-tier and input-handling weakness classes including cross-site scripting, path traversal, CSRF, and malformed-structure handling that are characteristic of management interfaces and middleware systems. Defenders should prioritize this vendor's advisories in telecom and service-delivery infrastructure; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ericsson over time
Of all the CVEs published by Ericsson as a CNA, 85.7% affect products that Ericsson develops as a vendor.
Of all the CVEs published that affect products developed by Ericsson, 52.2% are self-published by Ericsson as a CNA.
Signals from CVEs in this vendor scope (46 CVEs).
46 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10081CRITICAL CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the API URL ends with Auth | Nov 6, 2024 | 10.0 | 61 | NO | YES |
CVE-2015-2166MEDIUM Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via | Apr 6, 2015 | 5.0 | 45 | NO | YES |
CVE-2021-43339HIGH In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin | Nov 3, 2021 | 8.8 | 44 | NO | YES |
CVE-2026-25660CRITICAL CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the URL ends with Authenti | Apr 24, 2026 | 9.8 | 36 | NO | NO |
CVE-2025-27261CRITICAL Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data. | Sep 25, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-27258CRITICAL Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. | Oct 13, 2025 | 9.8 | 29 | NO | NO |
CVE-2003-1442HIGH The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access from the LAN side. | Dec 31, 2003 | 7.5 | 29 | NO | YES |
CVE-2025-40837HIGH Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended. | Sep 25, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-40836CRITICAL Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges. | Sep 25, 2025 | 9.8 | 27 | NO | NO |
CVE-2021-41390HIGH In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection. | Sep 17, 2021 | 8.0 | 26 | NO | NO |
Signals from CVEs in this vendor scope (46 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ericsson.
Media articles that mention a CVE ID that affects a product developed by Ericsson — matched by CVE ID, not by vendor name.