CVE-2018-15138

This bug is like a “file request” form that should only hand out approved documents, but it can be tricked into reaching into other folders on the server using path tricks (the “../” pattern). If an attacker can reach that feature, they may be able to view sensitive files that weren’t meant to be downloadable. There’s exploit code publicly available, so the risk is higher than a theoretical issue.

This matters if your business uses Ericsson-LG iPECS NMS 30M for managing phone/communication infrastructure and you have its web download function reachable from outside your trusted internal network. It’s most relevant when someone on the internet (or any untrusted network) can access the ipecs-cm/download endpoint. The real-world risk is primarily if the vulnerable URL is reachable from the internet or otherwise accessible to an attacker.

Treat this as an urgent AMBER issue because there is public exploit code available and the vulnerability involves reading files that could contain sensitive information. Even though a definitive patch is not known from the provided findings, you should prioritize exposure checks and access restrictions immediately, especially if the system is internet-accessible.

1. Identify exposure

   • Find the iPECS NMS 30M host(s) and determine where the web interface is published.
   • Check firewall rules, reverse proxy routing, and any NAT mappings to confirm whether requests to “/ipecs-cm/download” can be made from the public internet.

2. Confirm the relevant endpoint is reachable

   • From a non-production test machine, attempt a safe check to verify the endpoint is accessible only from trusted networks (do not attempt exploit strings in production).
   • Document all IP ranges that currently have access (internal admin IPs, VPN ranges, office networks, etc.).

3. Look for signs of probing

   • Review web access logs and application logs for URL patterns containing “ipecs-cm/download” and particularly “filename=../” or other “../” path traversal patterns.
   • If logs are retained, check for unusual spikes in requests to that path.

4. Get the fixed version from the vendor/integrator

   • The provided findings include “no fix/patch information available,” so you should contact your Ericsson-LG/iPECS support channel to request the remediation for CVE-2018-15138 and the exact fixed build/version.
   • Ask whether mitigation steps are available if patching is delayed (for example, request validation rules or disabling the download function).

5. Apply compensating controls if a fix is not available yet

   • Block public internet access to the ipecs-cm/download endpoint (or the entire iPECS NMS web interface) and allow it only from a locked-down management network/VPN.
   • Enforce access controls at the reverse proxy/WAF (if you have one), such as denying requests with “../” in the filename parameter.

6. After changes

   • Re-check that the endpoint is not reachable from untrusted networks.
   • Continue log monitoring for attempted traversal patterns.

7. Reporting

   • If you find exploitation/probing attempts in logs, escalate internally and to your vendor support team for guidance on whether incident handling steps are needed.

CVE-2018-15138 is a directory traversal vulnerability (CWE-22) in Ericsson-LG iPECS NMS 30M’s download feature, where an attacker can supply a crafted filename parameter in the ipecs-cm/download?filename=../ URI pattern to escape the intended directory and potentially read arbitrary files. The findings indicate a public exploit exists (weaponization), which increases real-world risk compared with purely theoretical vulnerabilities. No official KEV entry is provided, and no patch/fixed version information is available in the supplied findings; exploitation maturity appears supported by the availability of public exploit code. EPSS is reported as a prediction with a falling trend, but that alone is not treated as decisive versus known exploit availability. Press attention is noted as rising, but the action priority is driven primarily by the presence of public exploit code plus the file-read nature described.