Ericsson Packet Core Controller vulnerabilities

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.

A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.

A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.

Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.