CVE-2026-25657: Ericsson Packet Core Gateway DOS Flaw

CVE-2026-25657 Overview

CVE-2026-25657 affects Ericsson Packet Core Gateway (PCG) versions prior to 1.30. The vulnerability stems from Improper Handling of Syntactically Invalid Structure [CWE-228]. An attacker on an adjacent network can continuously send a specially crafted message to trigger service degradation on the gateway. The condition persists for the duration of the attack, and the system recovers once the malicious traffic stops. Ericsson Packet Core Gateway provides packet routing and traffic management in mobile core networks, making this issue relevant to telecommunications operators.

Critical Impact
A sustained stream of malformed messages causes the Packet Core Gateway to crash repeatedly, degrading mobile core network service availability until the attack ceases.

Affected Products

Ericsson Packet Core Gateway (PCG) versions prior to 1.30
Mobile core network deployments using vulnerable PCG releases
Operator environments exposing PCG signaling interfaces to adjacent network segments

Discovery Timeline

2026-06-05 - CVE-2026-25657 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-25657

Vulnerability Analysis

The vulnerability is a denial-of-service condition rooted in improper parsing of malformed protocol messages. When the Packet Core Gateway receives a syntactically invalid structure, the message handler fails to validate the input safely and the affected process crashes. Repeated delivery of the malformed message keeps the service in a degraded state. Because the gateway recovers when the malicious traffic stops, the impact targets availability rather than confidentiality or integrity. In a mobile core network, sustained PCG degradation can disrupt subscriber sessions, signaling, and data plane services.

Root Cause

The root cause is improper handling of syntactically invalid structures [CWE-228]. The PCG message-processing logic does not gracefully reject or recover from malformed input. Parsing errors propagate to a code path that terminates the handling process instead of discarding the offending packet.

Attack Vector

Exploitation requires adjacent network access to a signaling interface reachable by the Packet Core Gateway. No authentication, user interaction, or elevated privileges are required. The attacker continuously transmits a specially crafted malformed message to sustain service degradation. The attack does not yield code execution or data exposure and ceases when the malicious traffic stops.

No public proof-of-concept code is available. See the Ericsson Security Advisory CVE-2026-25657 for vendor technical details.

Detection Methods for CVE-2026-25657

Indicators of Compromise

Repeated process crashes or restarts on Packet Core Gateway nodes correlated with inbound traffic spikes
Bursts of malformed signaling messages observed on adjacent network interfaces facing the PCG
Elevated session setup failures or subscriber-impacting outages during the attack window

Detection Strategies

Monitor PCG service health metrics and process supervisor logs for crash-and-restart loops
Inspect signaling traffic for malformed protocol structures targeting the PCG control plane
Correlate gateway availability dips with source IPs or peer nodes sending non-conformant messages

Monitoring Recommendations

Forward PCG syslog, crash, and watchdog events to a centralized SIEM for alerting on restart frequency
Baseline normal signaling traffic volume and message validity rates to flag deviations
Enable alerting on packet parser error counters exposed by the PCG management interface

How to Mitigate CVE-2026-25657

Immediate Actions Required

Upgrade Ericsson Packet Core Gateway to version 1.30 or later as defined in the vendor advisory
Restrict adjacent network access to PCG signaling interfaces to trusted peers only
Increase monitoring of PCG availability and crash counters until patching is complete

Patch Information

Ericsson has addressed CVE-2026-25657 in Packet Core Gateway version 1.30. Operators should follow the upgrade guidance in the Ericsson Security Advisory CVE-2026-25657. Apply the update during a maintenance window and validate gateway stability after deployment.

Workarounds

Apply access control lists on adjacent network segments to limit which peers can reach PCG signaling endpoints
Deploy rate limiting and malformed-packet filtering on upstream network elements where supported
Segment the transport network so untrusted hosts cannot reach the PCG control plane

bash

# Example: restrict access to PCG signaling interface to trusted peers
# Replace addresses with operator-specific signaling peers
iptables -A INPUT -i <pcg_signaling_iface> -s <trusted_peer_subnet> -j ACCEPT
iptables -A INPUT -i <pcg_signaling_iface> -j DROP