CVE-2025-59172: Ericsson Packet Core Controller RCE Flaw

CVE-2025-59172 Overview

CVE-2025-59172 is an OS command injection vulnerability in the Ericsson Packet Core Controller (PCC) product. Versions prior to 1.38 fail to neutralize special elements in input, allowing an authenticated attacker on an adjacent network to execute arbitrary code as root. The flaw maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.

PCC is a mobile core network component that governs packet routing and policy enforcement for subscriber traffic. Root-level code execution on this platform can compromise control-plane integrity across a carrier environment.

Critical Impact
An attacker with high privileges on an adjacent network can execute arbitrary commands as root on the PCC, resulting in full compromise of the affected node.

Affected Products

Ericsson Packet Core Controller (PCC) versions prior to 1.38
Mobile core deployments using vulnerable PCC releases
Any operator environment where PCC management interfaces are reachable from adjacent networks

Discovery Timeline

2026-07-27 - CVE-2025-59172 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2025-59172

Vulnerability Analysis

CVE-2025-59172 is an operating system command injection issue in Ericsson PCC. The product does not properly neutralize special shell metacharacters before passing user-supplied input to an underlying operating system command. When crafted input reaches the vulnerable component, the shell interprets injected metacharacters and executes attacker-controlled commands.

Because the vulnerable process runs with root privileges, successful exploitation grants complete control of the PCC node. An attacker can read or modify configuration, pivot into adjacent management systems, and disrupt subscriber traffic policy enforcement.

The attack vector is Adjacent Network, meaning the attacker must reach the vulnerable interface from a network logically adjacent to the target, such as a management VLAN or an internal operations network. High privileges are required, which typically implies a compromised administrative account or an insider with legitimate access.

Root Cause

The root cause is missing or insufficient input sanitization on a code path that constructs an operating system command string from untrusted data. Special characters such as ;, |, &, backticks, and $() are not filtered or escaped before the command is passed to a shell interpreter. This pattern is classified under CWE-78.

Attack Vector

An authenticated attacker with high privileges submits crafted input to a PCC interface that eventually reaches a system command. The injected shell metacharacters break out of the intended argument context and append attacker-controlled commands. The commands execute in the context of the PCC service account, which runs as root.

No verified proof-of-concept code is publicly available. Refer to the Ericsson Security Bulletin July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2025-59172

Indicators of Compromise

Unexpected child processes spawned by PCC service binaries, particularly shells such as /bin/sh or /bin/bash
Outbound network connections from the PCC node to unfamiliar hosts on the operations network
Root-owned files created in temporary directories such as /tmp or /var/tmp shortly after administrative sessions
Audit log entries containing shell metacharacters (;, |, &&, backticks) in fields that expect plain values

Detection Strategies

Monitor process ancestry on PCC nodes for shell invocations descending from application processes that should not spawn shells
Review authentication and session logs for high-privilege accounts accessing PCC management interfaces from unusual sources
Correlate configuration change events with concurrent process execution anomalies
Compare running PCC versions against 1.38 to identify unpatched nodes

Monitoring Recommendations

Forward PCC audit, authentication, and process telemetry to a centralized analytics platform for retention and correlation
Alert on any invocation of interpreters or network utilities (curl, wget, nc) from PCC service accounts
Track privileged account activity on adjacent management networks and flag lateral movement toward core network elements

How to Mitigate CVE-2025-59172

Immediate Actions Required

Upgrade Ericsson PCC to version 1.38 or later as directed in the Ericsson Security Bulletin July 2026
Restrict management-plane access to PCC to a hardened jump host and a minimal set of authorized administrators
Rotate credentials for any high-privilege accounts that could reach the vulnerable interface
Review recent audit logs on all PCC nodes for signs of command injection attempts

Patch Information

Ericsson has released a fixed version of PCC. Upgrade to PCC 1.38 or later. Consult the Ericsson Security Bulletin July 2026 for release artifacts, upgrade procedures, and any prerequisites specific to your deployment.

Workarounds

Enforce strict network segmentation so that only designated administrative subnets can reach PCC management interfaces
Require multi-factor authentication and just-in-time access approval for all high-privilege PCC accounts
Disable or restrict PCC administrative features that are not required in production until the upgrade is completed

bash

# Example: restrict PCC management access at the network layer
# Replace interface and subnet values with those used in your environment
iptables -A INPUT -i mgmt0 -s 10.10.20.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i mgmt0 -p tcp --dport 443 -j DROP