CVE-2025-59180 Overview
CVE-2025-59180 is a hardcoded credential vulnerability [CWE-798] affecting Ericsson Packet Core Controller (PCC) versions prior to 1.38. The flaw resides in the PCC alarm system, where credentials are embedded directly into the product. An attacker with local cluster access and knowledge of the hardcoded credential can read alarm and alert information from the affected system.
The vulnerability requires local access to the cluster, which limits remote exploitation potential. Exploitation exposes operational telemetry from mobile packet core infrastructure, which could aid attackers in reconnaissance against telecommunications environments.
Critical Impact
Attackers with local cluster access and the hardcoded credential can read alarm and alert data from Ericsson PCC deployments, exposing sensitive operational information about mobile packet core infrastructure.
Affected Products
- Ericsson Packet Core Controller (PCC) versions prior to 1.38
- Deployments using the PCC alarm system component
- Clusters running unpatched PCC releases
Discovery Timeline
- 2026-07-27 - CVE-2025-59180 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2025-59180
Vulnerability Analysis
The Ericsson Packet Core Controller ships with credentials that are hardcoded into the alarm system component. Any actor who obtains this static credential and reaches the alarm interface from within the cluster can authenticate and retrieve alarm and alert records. Because the credential is embedded in the product, it is identical across deployments running the affected versions.
Alarm and alert data typically describes system health, subscriber-plane conditions, and operational anomalies. Exposure of this data does not directly compromise subscriber traffic, but it provides an attacker with insight into the state of a mobile network operator's packet core. This information supports reconnaissance and can inform follow-on attacks against adjacent infrastructure.
The issue is scoped to reading alarm information. The advisory does not indicate write access, configuration change, or code execution paths through this specific credential.
Root Cause
The root cause is the presence of static, embedded authentication material in the alarm system code path, categorized under [CWE-798] Use of Hard-coded Credentials. Static secrets shipped in product binaries cannot be rotated by operators and remain valid across all installations of the affected versions until a patched release is deployed.
Attack Vector
Exploitation requires local access to the PCC cluster. An attacker positioned inside the cluster boundary, whether through a compromised adjacent workload, a malicious insider, or lateral movement from another foothold, can present the hardcoded credential to the alarm interface. Successful authentication returns alarm and alert content. Network segmentation and strict cluster access controls are the primary barriers preventing exploitation.
No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-59180
Indicators of Compromise
- Authentication events against the PCC alarm system originating from unexpected in-cluster workloads or accounts
- Unusual read patterns against alarm and alert endpoints outside normal operational tooling schedules
- Access to alarm interfaces from hosts that have no documented operational role in PCC monitoring
Detection Strategies
- Inventory PCC nodes and identify all instances running versions prior to 1.38
- Enable and centralize authentication logging for the PCC alarm system to a security data lake
- Correlate alarm system access events with source workload identity and expected administrator activity
- Alert on any alarm system authentication that does not originate from approved management systems
Monitoring Recommendations
- Ingest PCC cluster audit and authentication logs into your SIEM for long-term retention and correlation
- Baseline normal alarm-read behavior and flag deviations in volume, source, or timing
- Monitor east-west traffic to the PCC alarm service and alert on connections from non-management subnets
How to Mitigate CVE-2025-59180
Immediate Actions Required
- Upgrade Ericsson Packet Core Controller to version 1.38 or later, which remediates the hardcoded credential
- Restrict network reachability to the PCC alarm system to a minimal set of authorized management hosts
- Review recent alarm system access logs for authentication events that cannot be attributed to sanctioned tooling
- Enforce strict cluster admission controls to reduce the population of workloads that could reach the alarm interface
Patch Information
Ericsson has addressed CVE-2025-59180 in Packet Core Controller version 1.38. Refer to the Ericsson Security Bulletin July 2026 for vendor guidance, fixed versions, and upgrade procedures.
Workarounds
- Apply network-level segmentation so that only designated operations hosts can reach the PCC alarm service
- Limit cluster access to a small, audited set of operators and service accounts until the patch is deployed
- Increase logging verbosity on the alarm system and forward events to central monitoring for interim detection
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
