CVE-2025-59178
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.
Risk Assessment
An attacker can discover the list of system users, facilitating further social engineering or brute-force attacks on accounts.
Recommendation
Update Ericsson PCC to version 1.39 or later, which fixes this vulnerability.
Other vulnerabilities in Ericsson Packet Core Controller
See all- CVE-2025-59181Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.
- CVE-2025-59180Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.
- CVE-2025-59177Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.
- CVE-2025-59172High
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
Original NVD description (English source)
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.