CVE-2018-10285

Think of the iPECS NMS web app as a locked office where doors are supposed to require a key (login). This flaw means the “lock” can be bypassed, so a stranger who reaches the front door might enter without proper permission. Because the attacker may also be able to change or disrupt what the system does, it’s not just a nuisance—it's a real business risk.

This matters to you if you run or host Ericsson-LG iPECS NMS A.1Ac as a web application in your environment. Because the issue involves bypassing authentication, it’s most concerning when the web app is reachable from untrusted networks (especially the internet) or when it’s exposed beyond what your team needs. Treat it as a risk specifically when the web app can be reached by an attacker over the network.

This is AMBER: a public exploit is available, which means attackers can try it without inventing their own attack. Also, we did not find an official patch/fix in the available records, so you likely need vendor guidance and network-level mitigation immediately.