CVE-2025-59178 Overview
CVE-2025-59178 affects Ericsson Packet Core Controller (PCC) versions prior to 1.39. The vulnerability resides in the Configuration Management component and exposes sensitive system information [CWE-497]. An authenticated attacker on an adjacent network can enumerate other users configured on the system. The issue carries a CVSS 4.0 base score of 4.8 (Medium) and requires high privileges to exploit. Ericsson addressed the flaw in PCC version 1.39 and published details in its July 2026 security bulletin. No public proof-of-concept or in-the-wild exploitation has been reported.
Critical Impact
An authenticated adjacent-network attacker can enumerate user accounts on the Ericsson PCC, expanding the attack surface for follow-on credential attacks against mobile core infrastructure.
Affected Products
- Ericsson Packet Core Controller (PCC) versions prior to 1.39
- Configuration Management subsystem of the PCC
- Mobile core network deployments running vulnerable PCC releases
Discovery Timeline
- 2026-07-27 - CVE-2025-59178 published to NVD
- 2026-07-28 - Last updated in NVD database
- July 2026 - Ericsson publishes PCC security bulletin
Technical Details for CVE-2025-59178
Vulnerability Analysis
CVE-2025-59178 is an information disclosure vulnerability categorized under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The defect lies in the Configuration Management functionality of the Ericsson Packet Core Controller. The component returns data that allows an authenticated user to enumerate other user accounts present on the system. User enumeration of this kind provides attackers with a validated list of account identifiers, which shortens the path to credential-based attacks such as password spraying or targeted phishing. Because the PCC governs subscriber sessions and policy for mobile core traffic, exposure of administrative account details raises operational risk beyond a typical enterprise application.
Root Cause
The root cause is insufficient authorization filtering in the Configuration Management interface. The interface returns user-related metadata to callers who should only see their own scope. Ericsson has not published deeper implementation details in the public advisory.
Attack Vector
The attack vector is adjacent network with high privileges required and no user interaction. An attacker must already hold authenticated access to the management network segment of the PCC. From that position, the attacker queries Configuration Management endpoints and harvests user identifiers. The impact is limited to confidentiality and integrity of low-sensitivity data; availability is not affected. See the Ericsson Security Bulletin July 2026 for vendor-specific technical detail.
Detection Methods for CVE-2025-59178
Indicators of Compromise
- Unexpected authenticated queries against PCC Configuration Management endpoints from accounts that do not normally perform administrative reads.
- Bursts of enumeration-style requests against user or account listing resources within the PCC management plane.
- Access to the PCC OAM interface from adjacent network hosts not part of the approved management inventory.
Detection Strategies
- Enable verbose audit logging on the PCC Configuration Management component and forward events to a centralized SIEM for correlation.
- Baseline normal administrative read patterns and alert on deviations, such as high-volume user list retrievals by non-administrator roles.
- Correlate PCC management-plane access with network access control lists to identify sessions originating outside the sanctioned OAM subnet.
Monitoring Recommendations
- Monitor authentication and authorization decisions on the PCC management interface for anomalies tied to privilege boundaries.
- Track privileged account activity on PCC nodes and alert on lateral use of the same credentials across other core network elements.
- Review vendor security bulletins on a recurring cadence and map advisories to inventory of deployed PCC versions.
How to Mitigate CVE-2025-59178
Immediate Actions Required
- Upgrade Ericsson Packet Core Controller to version 1.39 or later as specified in the vendor bulletin.
- Restrict access to the PCC OAM and Configuration Management interfaces to a hardened, isolated management VLAN.
- Audit all PCC user accounts and remove or downgrade unused high-privilege accounts to reduce exploitation prerequisites.
Patch Information
Ericsson has released PCC version 1.39, which remediates CVE-2025-59178. Operators should follow the vendor upgrade guidance published in the Ericsson Security Bulletin July 2026. Validate the upgrade in a staging environment before production rollout given the operational sensitivity of mobile core systems.
Workarounds
- Enforce strict network segmentation so that only jump hosts on the approved OAM segment can reach PCC management endpoints.
- Apply role-based access control reviews on the PCC to minimize the number of accounts with authenticated management access.
- Enable multi-factor authentication on all PCC administrative accounts to raise the cost of credential reuse following enumeration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
