CVE-2021-28485

low-risk

Published 2023-09-14

In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application.

Do I need to act?

0.49% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Mobile Switching Center Server Bc 18A Firmware

Affected Vendors

Ericsson

References (4)

Vendor Advisory https://www.ericsson.com/en/about-us/security/psirt

Third Party Advisory https://www.gruppotim.it/it/footer/red-team.html

Vendor Advisory https://www.ericsson.com/en/about-us/security/psirt

Third Party Advisory https://www.gruppotim.it/it/footer/red-team.html

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal