Ericsson Packet Core Controller CVE-2025-59174

Attacker must have logical adjacency to the Packet Core Controller's signaling interface (CVSS AV:A - same broadcast/routing domain as the PCC, typically an operator's internal 5G/4G signaling network or a peered roaming/interconnect link), with no authentication or user interaction required once that access is obtained. Exploitation requires the ability to generate and transmit a large volume of specially crafted protocol messages, so the attack is not feasible from the public internet against a properly segmented core network and is limited to environments where the PCC's control-plane interfaces are reachable by the attacker. Affected only on PCC versions prior to 1.39.

The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VA:H) indicates an adjacent-network attacker - meaning the attacker must already be on the same logical signaling network segment as the PCC, not a remote internet attacker - which substantially limits exposure since mobile-core signaling networks are typically isolated from public networks. No EPSS score, KEV listing, or public POC was provided, and the description ('Information Disclosure' tag conflicts with the CVSS vector which shows VC:N - no confidentiality impact, only availability), suggesting the tag may be inaccurate and the true impact is service degradation only. Real-world priority is moderate for telco operators where signaling-plane access is possible (rogue insider, compromised peer NF, lawful-intercept lateral movement) but low for organizations with strong network segmentation; the conflicting 'Information Disclosure' tag versus VA:H-only vector should be verified with Ericsson PSIRT.

An attacker with access to the operator's signaling network - for example a compromised peer 5G network function, a malicious roaming partner, or a rogue insider on the management VLAN - sends a sustained high-volume stream of malformed control-plane messages to the PCC. The controller's parser consumes excessive resources handling the invalid structures, leading to degraded session-management throughput or controller unresponsiveness that disrupts subscriber connectivity. No public exploit identified at time of analysis.