CVE-2025-59177 Overview
CVE-2025-59177 affects Ericsson Packet Core Controller (PCC) versions prior to 1.39. The vulnerability resides in the Configuration Management component. An attacker with high privileges on an adjacent network can submit crafted commands that trigger verbose error messages. Those error messages expose system secrets to the caller.
The issue is classified under CWE-209: Generation of Error Message Containing Sensitive Information. Ericsson published the fix in the Ericsson Security Bulletin July 2026.
Critical Impact
An authenticated attacker on an adjacent network can extract sensitive system secrets from PCC error output, undermining the confidentiality of a mobile core network control plane component.
Affected Products
- Ericsson Packet Core Controller (PCC) versions prior to 1.39
- Mobile core network deployments relying on PCC for policy and charging control
- Operator management planes with adjacent-network access to PCC configuration interfaces
Discovery Timeline
- 2026-07-27 - CVE-2025-59177 published to NVD
- 2026-07-28 - Last updated in NVD database
- July 2026 - Ericsson publishes PCC security bulletin
Technical Details for CVE-2025-59177
Vulnerability Analysis
The Ericsson Packet Core Controller handles configuration commands submitted through its management interface. When the PCC processes specifically crafted commands, its Configuration Management component generates error messages that include sensitive internal state. The returned text contains system secret material rather than a sanitized failure indicator.
The vulnerability is an information disclosure issue rooted in verbose error handling. It does not enable code execution or data modification. The impact is limited to confidentiality of the PCC control plane, but the exposed material can support follow-on attacks against the mobile core.
Exploitation requires adjacent-network access and high privileges on the management surface. The complexity is low and no user interaction is needed. Attackers who already hold operator or administrative access can escalate their knowledge of internal secrets used elsewhere in the network.
Root Cause
The root cause is improper handling of failure paths in Configuration Management. Diagnostic error messages include raw internal values instead of redacted, generic responses. This matches the [CWE-209] pattern where debugging output is exposed to the requester.
Attack Vector
An attacker with high privileges on an adjacent network segment issues crafted configuration commands to the PCC. The commands are engineered to force error conditions in code paths that reference sensitive state. The PCC returns error output containing that state to the attacker.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Ericsson Security Bulletin July 2026 for vendor-supplied technical detail.
Detection Methods for CVE-2025-59177
Indicators of Compromise
- Unusual volumes of failed or malformed configuration commands sent to PCC management endpoints from adjacent network hosts.
- Configuration Management error events referencing sensitive fields such as credentials, keys, or internal identifiers in their message body.
- Authenticated management sessions performing systematic command permutations against configuration APIs.
Detection Strategies
- Inspect PCC audit and application logs for repeated configuration command failures tied to a single privileged account.
- Alert on error messages whose payload length or content deviates from the expected sanitized format.
- Correlate high-privilege operator logins with subsequent bursts of configuration errors within a short window.
Monitoring Recommendations
- Forward PCC management-plane logs to a centralized SIEM for retention and correlation.
- Baseline normal configuration command volume and content per administrator, then alert on deviations.
- Monitor adjacent-network segments feeding the PCC management interface for unexpected sources or lateral movement.
How to Mitigate CVE-2025-59177
Immediate Actions Required
- Upgrade Ericsson Packet Core Controller to version 1.39 or later as directed by the vendor bulletin.
- Rotate any credentials, keys, or shared secrets that may have been referenced by PCC configuration error output.
- Restrict management-plane access to a minimal set of jump hosts and enforce multi-factor authentication for privileged accounts.
Patch Information
Ericsson addressed CVE-2025-59177 in PCC version 1.39. Operators should follow the upgrade guidance in the Ericsson Security Bulletin July 2026 and validate the deployed build after the change window.
Workarounds
- Isolate the PCC management interface on a dedicated, tightly filtered adjacent network segment.
- Limit high-privilege configuration accounts to named administrators and disable shared operator credentials.
- Enable strict logging and periodic review of configuration command errors until the patched version is deployed.
- Apply network access control lists so only approved management hosts can reach the PCC configuration endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
