Exposure of Sensitive System Information in Ericsson Packet Core Controller
CVE-2025-59178

4.8MEDIUM

Key Information:

Vendor

Ericsson

Status
Packet Core Controller (pcc)
Vendor
CVE Published:
27 July 2026

What is CVE-2025-59178?

The Ericsson Packet Core Controller (PCC) is vulnerable to an exposure of sensitive system information, particularly in its Configuration Management feature. This vulnerability can potentially allow an attacker to enumerate other users on the system, leading to unauthorized access or data leaks. Users of PCC versions prior to 1.39 should apply recommended updates to mitigate this risk.

Affected Version(s)

Packet Core Controller (PCC) 0 < 1.39

References

https://www.ericsson.com/en/about-us/security/psirt/secur...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Spark NZ
Radu Balaci and Meghna Patel from Bell Mobility (Canada)
.