CVE-2024-25010: Ericsson RAN Compute RCE Vulnerability

CVE-2024-25010 Overview

CVE-2024-25010 is a high-severity improper input validation vulnerability affecting Ericsson RAN Compute and Site Controller 6610 in certain configurations. An attacker with adjacent network access can exploit the flaw to achieve arbitrary code execution on affected radio access network infrastructure. The weakness maps to [CWE-20] (Improper Input Validation) and impacts confidentiality, integrity, and availability of the affected node. Because the products sit within the Radio Access Network (RAN) of mobile operator environments, successful exploitation could compromise a component in the critical mobile telecommunications infrastructure path.

Critical Impact
Adjacent-network attackers can execute arbitrary code on Ericsson RAN Compute and Site Controller 6610 nodes, potentially compromising radio access network operations.

Affected Products

Ericsson RAN Compute (certain configurations)
Ericsson Site Controller 6610 (certain configurations)
Refer to the Ericsson Security Advisory for exact affected releases

Discovery Timeline

2025-05-22 - CVE-2024-25010 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25010

Vulnerability Analysis

The vulnerability originates in input handling routines within Ericsson RAN Compute and Site Controller 6610 firmware. When the affected products receive network input under specific configurations, the software fails to correctly validate that input before processing. An attacker who can send crafted messages from an adjacent network position can trigger the flaw and steer execution into attacker-controlled code paths.

Because the products operate as radio access network components, exploitation grants a foothold in the mobile network fabric. From there, an attacker can pivot toward baseband functions, management interfaces, or transport paths that connect to the core network. Ericsson categorizes the defect as high severity and has published remediation guidance through its Product Security Incident Response Team (PSIRT).

Root Cause

The root cause is improper input validation ([CWE-20]). Input received by the affected components is processed without adequate boundary, type, or content checks. In vulnerable configurations, this permits an attacker to submit malformed data that the software treats as valid, ultimately corrupting control flow or data used by privileged execution paths.

Attack Vector

Exploitation requires adjacent-network access to the target node. No authentication and no user interaction are required. An attacker positioned on a network segment reachable by the RAN Compute or Site Controller 6610 management or signaling interface can send crafted traffic to the vulnerable service. Successful exploitation yields arbitrary code execution with the privileges of the affected process.

No verified public exploit code is available. Technical specifics have not been published beyond the vendor advisory. See the Ericsson Security Advisory for authoritative technical details.

Detection Methods for CVE-2024-25010

Indicators of Compromise

Unexpected process execution or new binaries running on RAN Compute or Site Controller 6610 nodes
Anomalous outbound connections from RAN management interfaces to unknown hosts
Unexplained configuration changes or new administrative sessions on affected devices
Malformed or oversized packets on adjacent management or O&M network segments

Detection Strategies

Monitor management-plane traffic to RAN nodes for protocol violations and payload anomalies
Baseline normal signaling and O&M traffic patterns and alert on deviations
Correlate authentication, configuration, and process telemetry from RAN infrastructure in a central analytics platform
Review vendor-supplied logs and diagnostic counters referenced in the Ericsson advisory

Monitoring Recommendations

Restrict and log all access to RAN O&M network segments, treating them as high-value zones
Alert on new or unexpected listening services on RAN Compute and Site Controller 6610 nodes
Continuously monitor firmware and configuration integrity of affected products
Track PSIRT advisories from Ericsson for updates and additional indicators

How to Mitigate CVE-2024-25010

Immediate Actions Required

Inventory all Ericsson RAN Compute and Site Controller 6610 deployments and identify vulnerable configurations
Apply the security update referenced in the Ericsson Security Advisory as soon as change windows allow
Restrict adjacent-network access to management and signaling interfaces to authorized hosts only
Verify that RAN management networks are segmented from general enterprise and internet-facing networks

Patch Information

Ericsson has issued remediation guidance through its PSIRT. Operators should consult the Ericsson Security Advisory for the list of fixed releases and upgrade procedures applicable to their RAN Compute and Site Controller 6610 deployments. Ericsson customers should coordinate patch deployment with their account teams to align with maintenance windows for radio access infrastructure.

Workarounds

Enforce strict access control lists on RAN O&M interfaces, limiting sources to trusted management jump hosts
Deploy network segmentation and firewalling between RAN management VLANs and other network zones
Disable or restrict any optional services and configurations flagged by Ericsson as contributing to exposure
Increase logging and monitoring on affected nodes until patches can be applied

bash

# Example: restrict management access to Ericsson RAN nodes at the network edge
# Replace interface, ACL, and address values with those appropriate for the environment
access-list RAN_OAM_IN permit tcp host 10.10.0.10 host 10.20.30.40 eq 22
access-list RAN_OAM_IN permit tcp host 10.10.0.10 host 10.20.30.40 eq 443
access-list RAN_OAM_IN deny   ip any host 10.20.30.40 log
access-list RAN_OAM_IN permit ip any any

interface GigabitEthernet0/1
 description RAN O&M uplink
 ip access-group RAN_OAM_IN in