CVE-2025-59178 in Packet Core Controller
Summary
by MITRE • 07/27/2026
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The Ericsson Packet Core Controller represents a critical component in telecommunications infrastructure responsible for managing packet core network functions and user sessions within mobile networks. This system serves as the central management point for controlling subscriber access, authentication, and session handling across cellular networks. The vulnerability exists within the Configuration Management module of PCC versions earlier than 139, specifically affecting how the system handles user enumeration requests and sensitive information exposure during configuration operations.
This security flaw constitutes a sensitive system information exposure vulnerability that falls under the CWE-200 category, where the system inadvertently reveals information about its internal structure or user base. The issue manifests when the Configuration Management component fails to properly validate or restrict access to user enumeration functions, allowing unauthorized parties to query and discover details about other system users without proper authentication or authorization. Attackers can exploit this weakness to systematically identify valid user accounts, potentially leading to further compromise of the network infrastructure.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates a foundation for more sophisticated attacks within the telecommunications environment. An attacker who successfully exploits this vulnerability gains knowledge about legitimate user accounts, which can then be used for credential stuffing attacks against other systems or as part of broader reconnaissance efforts targeting the overall network infrastructure. The exposure of user enumeration capabilities also violates fundamental security principles of least privilege and proper access control enforcement that should be maintained in telecommunications management systems.
From a threat modeling perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework under the T1087.001 technique for account discovery, where adversaries seek to identify user accounts on compromised systems. The flaw enables attackers to perform reconnaissance activities that would normally require elevated privileges or legitimate administrative access to achieve. Organizations running affected PCC versions face potential risks including unauthorized network access, data breaches involving subscriber information, and possible escalation to more critical vulnerabilities within the packet core infrastructure.
Effective mitigation strategies include immediate deployment of Ericsson's official security patches and updates addressing this specific vulnerability in Configuration Management. Network administrators should implement strict access controls and authentication mechanisms for all configuration management interfaces, ensuring that only authorized personnel can perform user enumeration or system information queries. Regular security assessments and penetration testing should be conducted to verify proper implementation of access controls and monitor for similar vulnerabilities across the telecommunications infrastructure. Additionally, organizations should maintain comprehensive network monitoring capabilities to detect anomalous access patterns or unauthorized enumeration attempts targeting the packet core management systems.
The vulnerability highlights critical gaps in telecommunications security practices and emphasizes the importance of proper input validation and access control implementation in mission-critical network management components. Given the sensitive nature of telecommunications data and the potential for cascading effects from compromised management systems, organizations must prioritize remediation efforts and implement robust security controls to prevent exploitation of such information disclosure vulnerabilities within their core network infrastructure.