CVE-2025-59174: Ericsson Packet Core Controller DOS Flaw

CVE-2025-59174 Overview

CVE-2025-59174 affects Ericsson Packet Core Controller (PCC) versions prior to 1.39. The vulnerability allows an adjacent network attacker to send a large volume of specially crafted messages, causing service degradation. The flaw is categorized under [CWE-228] (Improper Handling of Syntactically Invalid Structure) and impacts the availability of the PCC, a core component in mobile packet core networks. No authentication or user interaction is required for exploitation, but the attacker must have access to the adjacent network where the PCC operates.

Critical Impact
An adjacent network attacker can degrade Ericsson Packet Core Controller service availability by flooding the system with crafted messages, disrupting mobile packet core operations.

Affected Products

Ericsson Packet Core Controller (PCC) versions prior to 1.39
Mobile packet core deployments relying on Ericsson PCC for signaling and session management
Carrier and enterprise 4G/5G networks using affected PCC versions

Discovery Timeline

2026-06-05 - CVE-2025-59174 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2025-59174

Vulnerability Analysis

The vulnerability resides in how the Ericsson Packet Core Controller processes incoming messages on its adjacent network interfaces. When the PCC receives a large volume of specially crafted messages, the processing logic fails to handle the syntactically invalid structures efficiently. This leads to resource exhaustion and service degradation, affecting the availability of mobile packet core services. The CWE-228 classification indicates the root issue is improper handling of malformed input structures during parsing or validation.

The attack targets availability only. Confidentiality and integrity of subscriber data and signaling are not impacted according to the CVSS vector. However, service degradation in a packet core controller can disrupt session establishment, mobility management, and policy enforcement for connected subscribers.

Root Cause

The root cause is improper handling of syntactically invalid message structures at scale. The PCC does not adequately rate-limit, validate, or discard malformed signaling messages before they consume processing resources. Repeated parsing attempts against crafted payloads exhaust CPU or memory, leading to degraded throughput on legitimate traffic.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same logical network segment as the PCC, such as a signaling network or carrier backhaul. The attacker sends a high volume of specially crafted messages targeting the PCC. No privileges or user interaction are required. Successful exploitation results in service degradation rather than full denial of service or code execution.

No public proof-of-concept code or exploit is currently available for CVE-2025-59174. Refer to the Ericsson Security Advisory for vendor-specific technical details.

Detection Methods for CVE-2025-59174

Indicators of Compromise

Sustained spikes in malformed or unparseable signaling messages directed at PCC interfaces
Elevated CPU or memory utilization on PCC nodes without a corresponding increase in legitimate subscriber sessions
Increased session setup failures, timeouts, or dropped control-plane transactions reported by adjacent network functions

Detection Strategies

Monitor PCC signaling interfaces for anomalous traffic volume and message validation error rates
Correlate adjacent network traffic patterns against baseline signaling behavior to identify flood conditions
Enable verbose logging on PCC message parsers to capture rejected or malformed message statistics

Monitoring Recommendations

Forward PCC operational logs and performance counters to a centralized SIEM for continuous analysis
Configure alerts on threshold breaches for malformed message rates and processing latency
Track availability metrics for downstream network functions that depend on PCC to detect cascading degradation early

How to Mitigate CVE-2025-59174

Immediate Actions Required

Upgrade Ericsson Packet Core Controller to version 1.39 or later as released by the vendor
Restrict adjacent network access to PCC signaling interfaces using network segmentation and access control lists
Review and tighten rate-limiting policies on signaling traffic reaching the PCC

Patch Information

Ericsson has addressed CVE-2025-59174 in Packet Core Controller version 1.39. Operators should consult the Ericsson Security Advisory for upgrade procedures, supported migration paths, and any prerequisite patches.

Workarounds

Deploy signaling firewalls or rate limiters in front of the PCC to drop malformed or excessive message floods
Isolate PCC management and signaling interfaces from untrusted adjacent networks via VLAN segmentation
Implement strict ingress filtering on adjacent network segments to allow only authorized peer network functions

bash

# Configuration example
# See the Ericsson Security Advisory for vendor-specific upgrade and hardening commands:
# https://ericsson.com/en/about-us/security/psirt/CVE-2025-59174