CVE-2025-59180
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.
Risk Assessment
The risk involves potential reading of sensitive alarm and alert information by an attacker with cluster access, which could compromise system confidentiality and security.
Recommendation
Update Ericsson Packet Core Controller to version 1.38 or later that fixes this vulnerability.
Other vulnerabilities in Ericsson Packet Core Controller
See all- CVE-2025-59181Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.
- CVE-2025-59178Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.
- CVE-2025-59177Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.
- CVE-2025-59172High
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
Original NVD description (English source)
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.