CVE-2025-59180 Ericsson CVE debrief

Who should care

Defenders responsible for Ericsson Packet Core Controller (PCC) deployments should assess exposure and implement compensating controls to prevent unauthorized access to alarm and alert information.

Why it matters

CVE-2025-59180 is a hardcoded credential vulnerability in Ericsson Packet Core Controller (PCC) versions prior to 1.38. Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized access to alarm and alert information.

• Verification of PCC version and exposure to the hardcoded credential vulnerability
• Implementation of compensating controls to prevent unauthorized access to alarm and alert information
• Monitoring for suspicious activity related to alarm and alert information

Technical summary

The vulnerability exists in Ericsson Packet Core Controller (PCC) versions prior to 1.38, where a hardcoded credential is present in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized access to alarm and alert information.

Recommended defensive actions

• Verify PCC version and check for exposure
• Implement compensating controls to prevent unauthorized access
• Monitor for suspicious activity related to alarm and alert information

Evidence notes

The CVE record and NVD entry provide details on the hardcoded credential vulnerability in Ericsson Packet Core Controller (PCC). The vulnerability is present in versions prior to 1.38. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information. The source details are limited, and defenders should verify exposure and implement compensating controls to prevent unauthorized access. The CVE record was published on 2026-07-27T15:16:

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.