CVE-2025-59172
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
Risk Assessment
Risk of full compromise of the PCC device, potentially disrupting core network operations and causing significant losses for the operator.
Recommendation
Update Ericsson PCC to version 1.38 or later, which fixes this vulnerability.
Other vulnerabilities in Ericsson Packet Core Controller
See all- CVE-2025-59181Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.
- CVE-2025-59180Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.
- CVE-2025-59178Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.
- CVE-2025-59177Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.
Original NVD description (English source)
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.