CVE-2025-59177 Ericsson CVE debrief

Who should care

Users of Ericsson Packet Core Controller (PCC) versions prior to 1.39 should review and apply the necessary patches to mitigate the vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact and implement compensating controls if necessary.

Technical summary

The Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management. This vulnerability allows an attacker to execute specifically crafted commands to reveal system secrets through error messages. The CVSS score for this vulnerability is 6.8, indicating a medium severity. Affected users should prioritize patching due to the potential for system secret exposure.

Defensive priority

Medium priority should be given to patching Ericsson Packet Core Controller (PCC) versions prior to 1.39 due to the medium severity of the vulnerability and the potential for system secret exposure. Monitoring system logs for suspicious activity and implementing compensating controls are also recommended until patches are applied.

Recommended defensive actions

• Review and apply the necessary patches for Ericsson Packet Core Controller (PCC) versions prior to 1.39
• Monitor system logs for suspicious activity
• Implement compensating controls to limit access to Configuration Management

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and review of the Ericsson security bulletin are recommended. The evidence is based on official sources, but the scope and severity may need additional verification. Defenders should check for affected product deployments and review system logs for suspicious activity.

Official resources