CVE-2026-25658: Ericsson Packet Core Gateway DOS Flaw

CVE-2026-25658 Overview

CVE-2026-25658 affects Ericsson Packet Core Gateway (PCG) versions prior to 1.30. The vulnerability stems from Improper Handling of Missing Values [CWE-230] in the message processing logic. An attacker on an adjacent network can continuously send specially crafted messages to trigger service degradation on the gateway. The system recovers from crashes once the attack stops, but service remains impaired while traffic continues. Ericsson disclosed the issue in a Product Security Incident Response Team (PSIRT) advisory.

Critical Impact
Sustained transmission of crafted messages causes denial of service on the Ericsson Packet Core Gateway, disrupting mobile core network traffic for the duration of the attack.

Affected Products

Ericsson Packet Core Gateway (PCG) versions prior to 1.30
Mobile core network deployments using Ericsson PCG for user plane functions
5G and LTE infrastructure relying on the affected PCG releases

Discovery Timeline

2026-06-05 - CVE-2026-25658 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database
2026-06-11 - Exploit Prediction Scoring System (EPSS) data published

Technical Details for CVE-2026-25658

Vulnerability Analysis

The flaw is a Denial of Service condition rooted in improper handling of missing values within message processing on the Ericsson Packet Core Gateway. The component fails to validate that expected fields are present before consuming them, leading to a fault condition that degrades or crashes the affected service.

The vulnerability is exploitable from an adjacent network without authentication or user interaction. Confidentiality and integrity are not impacted, but availability of the user-plane function is impaired while the attack runs. Because Packet Core Gateways carry subscriber traffic for mobile operators, sustained degradation can interrupt large volumes of sessions.

The EPSS probability is 0.019% (percentile 5.246), indicating low observed exploitation likelihood at publication, though the network-critical role of PCG elevates operational risk.

Root Cause

The defect is classified as [CWE-230] Improper Handling of Missing Values. The PCG message parser does not safely handle inputs where required values are absent. When the parser dereferences or operates on the missing field, the process enters an error state that causes a crash. Because the gateway respawns the affected service, repeated malformed messages produce a loop of crashes and restarts, manifesting as service degradation.

Attack Vector

An attacker positioned on an adjacent network with reachability to the PCG signaling or control interfaces sends a stream of specially crafted messages. No credentials or user interaction are required. The impact persists only while messages continue. Once traffic stops, the service stabilizes without administrator intervention.

No public proof-of-concept or exploit code is available for CVE-2026-25658. See the Ericsson Security Advisory CVE-2026-25658 for vendor-specific technical details.

Detection Methods for CVE-2026-25658

Indicators of Compromise

Repeated crash and restart events for PCG user-plane or control-plane processes in element management logs
Spikes of malformed or truncated signaling messages directed at PCG interfaces from adjacent network segments
Periodic loss of subscriber sessions correlated with bursts of inbound signaling traffic

Detection Strategies

Monitor PCG process supervisor logs for abnormal restart frequency on packet processing services
Inspect signaling traffic for messages missing mandatory information elements or fields
Correlate availability alarms from network management with peer source addresses to identify attack origin

Monitoring Recommendations

Enable verbose logging on PCG message parsers to capture parse failures and the originating peers
Forward PCG syslog and fault events into a centralized analytics platform for cross-node correlation
Track baseline crash counts per service and alert on deviations exceeding normal operational thresholds

How to Mitigate CVE-2026-25658

Immediate Actions Required

Upgrade Ericsson Packet Core Gateway to version 1.30 or later as specified in the vendor advisory
Restrict adjacent network reachability to PCG signaling interfaces using access control lists and segmentation
Engage Ericsson support to confirm the upgrade path appropriate for the deployed release train

Patch Information

Ericsson has released a fixed version of Packet Core Gateway addressing CVE-2026-25658. Operators should consult the Ericsson Security Advisory CVE-2026-25658 for the authoritative remediation guidance and upgrade procedures.

Workarounds

Apply strict network segmentation so only authorized peer nodes can reach PCG control and signaling endpoints
Deploy rate limiting on inbound signaling channels to constrain volumetric malformed message attacks
Increase monitoring on PCG process health to enable rapid manual intervention while patching is scheduled

bash

# Example: restrict PCG signaling interface to authorized peers
iptables -A INPUT -p sctp -s <authorized_peer_subnet> -d <pcg_signaling_ip> -j ACCEPT
iptables -A INPUT -p sctp -d <pcg_signaling_ip> -j DROP