CVE-2025-59181
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.
Risk Assessment
The risk involves potential directory permission changes by an attacker, which could lead to denial of access for legitimate users and system disruption.
Recommendation
Update Ericsson Packet Core Controller to version 1.39 or later that fixes this vulnerability.
Other vulnerabilities in Ericsson Packet Core Controller
See all- CVE-2025-59180Medium
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.
- CVE-2025-59178Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.
- CVE-2025-59177Medium
A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.
- CVE-2025-59172High
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
Original NVD description (English source)
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.