CVE-2025-59178 Ericsson CVE debrief

Who should care

Defenders responsible for Ericsson PCC systems, particularly those with Configuration Management access, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2025-59178 because it allows attackers to enumerate system users, potentially leading to targeted attacks and compromising system security. PCC administrators and security teams should verify PCC versions, restrict Configuration Management access, and monitor system logs.

• Enumeration of system users may lead to targeted attacks
• Exposure of sensitive system information may compromise system security

Technical summary

The Ericsson Packet Core Controller (PCC) contains an Exposure of Sensitive System Information vulnerability in Configuration Management, allowing an attacker to enumerate other users on the system. This vulnerability can lead to targeted attacks and compromise system security. The vulnerability is due to inadequate access controls in Configuration Management, which allows an attacker to enumerate other users on the system. Defenders should prioritize verifying PCC versions and restricting Configuration Management access.

Defensive priority

Defenders should prioritize verifying PCC versions and restricting Configuration Management access.

Recommended defensive actions

• Verify PCC version and upgrade to 1.39 or later if necessary
• Restrict access to Configuration Management
• Monitor system logs for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the Exposure of Sensitive System Information vulnerability in Ericsson PCC. The vulnerability allows an attacker to enumerate other users on the system, potentially leading to targeted attacks and compromising system security. Defenders should verify PCC versions, restrict Configuration Management access, and monitor system logs. The source details are limited, and explicit evidence-limit language and defensive verification tasks are used

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.