CVE-2025-59177 in Packet Core Controller
Summary
by MITRE • 07/27/2026
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Ericsson Packet Core Controller PCC vulnerability represents a critical information disclosure flaw that undermines the security posture of mobile network infrastructure. This weakness exists within the configuration management subsystem of PCC versions earlier than 139, where improper error handling allows attackers to extract sensitive system secrets through carefully crafted commands. The vulnerability exposes fundamental security controls that should prevent unauthorized access to confidential operational data, creating a significant risk for telecommunications operators who rely on these controllers for network management.
The technical implementation of this flaw stems from inadequate input validation and error message generation within the configuration management interface. When attackers submit specifically designed commands to the system, the controller responds with detailed error messages that inadvertently contain sensitive information about system secrets, cryptographic keys, or authentication credentials. This occurs because the system does not properly sanitize or filter error responses before returning them to requesting entities, violating core security principles of least privilege and information hiding. The vulnerability aligns with CWE-209, which specifically addresses improper error message information exposure, and represents a classic example of how error handling can become a security vector rather than a defensive mechanism.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks within the network infrastructure. An attacker who successfully exploits this weakness could gain access to system secrets that would allow them to impersonate legitimate components, escalate privileges, or access other sensitive network resources. This exposure creates a pathway for lateral movement within the network and could compromise the integrity of the entire packet core infrastructure. The vulnerability affects the confidentiality and integrity aspects of the CIA triad, as it enables unauthorized disclosure of sensitive data while potentially undermining system authentication mechanisms.
Organizations using affected Ericsson PCC versions should implement immediate mitigations including upgrading to version 1.39 or later where the vulnerability has been patched. Network administrators should also consider implementing additional monitoring and logging controls to detect suspicious command patterns that might indicate exploitation attempts. The remediation process should include thorough security assessments of configuration management interfaces and implementation of proper error handling procedures that prevent sensitive information from being exposed in system responses. Organizations should also review their incident response procedures to ensure they can effectively detect and respond to potential exploitation of this vulnerability, as outlined in the mitre ATT&CK framework's information disclosure techniques.
Additional defensive measures include implementing network segmentation around critical configuration management interfaces, enforcing strict access controls for administrative functions, and deploying intrusion detection systems capable of identifying patterns associated with this specific vulnerability. Security teams should also conduct regular penetration testing to validate that error handling has been properly implemented across all system components and that no similar information disclosure vulnerabilities exist in related subsystems. The vulnerability serves as a reminder of the critical importance of secure coding practices and proper error handling in security-critical systems, particularly those managing sensitive network infrastructure components.