CVE-2021-32570

A group of AMOS users on Ericsson Network Manager can read log files under a shared path, and those logs contain enough information to help one of them escalate privileges. The root cause is sensitive data landing in log files that a peer authorization group can reach. This is not an outsider problem — it's an insider or lateral-movement problem, where someone already inside the system mines logs for material that lifts them above their assigned tier.

The description is candid about the precondition: every AMOS user is already a highly privileged, security-administrator-vetted account. So the population that can exploit this is small, trusted, and named. That's why the score sits at medium rather than high — the flaw is real, but it presumes an authorized privileged user turning malicious or having their account compromised. It's a defense-in-depth failure, not a breach vector, and the impact is confidentiality of log contents that then aid escalation.

Our framing is to prioritize this below its face value and slot it into insider-risk and least-privilege work rather than emergency patching. Where ENM below 21.2 runs, we'd note it as a privilege-separation weakness worth closing on the normal maintenance cadence, and pair it with monitoring of who is reading those log paths. The people who can abuse it are already logged and authorized, which makes detection more tractable than prevention here.