Is there a patch available for CVE-2025-59172?

Yes, a patch is available for CVE-2025-59172. Update the affected software to the latest version immediately.

Ericsson Packet Core Controller (PCC) CVE-2025-59172

Q: What is the CVSS score of CVE-2025-59172?

CVE-2025-59172 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210512 HIGH

OS Command Injection (CWE-78)

2026-07-27 ERIC

GHSA-8j5f-6vjg-rf7w

Command Injection RCE Ericsson Packet Core Controller Pcc

8.5

CVSS 4.0 · Vendor: ERIC

Severity by source

Vendor (ERIC) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent network attack vector and high privileges required; full compromise as root.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ERIC).

CVSS VectorVendor: ERIC

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 15:02 EUVD

Analysis Generated

Jul 27, 2026 - 15:00 vuln.today

CVE Published

Jul 27, 2026 - 14:03 cve.org

HIGH 8.5

DescriptionCVE.org

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

AnalysisAI

Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.

Technical ContextAI

The vulnerability is an OS command injection (CWE-78) in Ericsson Packet Core Controller, a software component handling mobile packet core functions. The CPE data indicates all versions prior to 1.38 are affected. The product likely processes input and passes it to a system shell without proper filtering, enabling execution of arbitrary commands. The attack vector adjacent network (AV:A) suggests the management interface is not exposed to the internet but accessible on the same network segment.

RemediationAI

Upgrade to Ericsson Packet Core Controller version 1.38 or later, as specified in the vendor advisory. No workaround is provided; restrict network access to the management interface to trusted adjacent networks and enforce strong, unique credentials for all privileged accounts. Monitor for unauthorized access attempts.