Packet Core Controller CVE-2025-59178

The attacker must have high privileges (administrative or operator-level access) on the affected PCC system and be positioned on the same adjacent network segment (AV:A). The configuration management feature must be enabled and reachable. No user interaction is required (UI:N). Authentication is required (PR:H) - the vulnerability is not accessible to unauthenticated remote attackers.

The CVSS v4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) indicates an adjacent network attack requiring high privileges, low attack complexity, and no user interaction. The base score of 4.8 (Medium) reflects limited confidentiality and integrity impact. No EPSS score, CISA KEV listing, or public exploit code is available in the input data, suggesting low real-world exploitation risk. The requirement for administrative access on an adjacent network significantly reduces the attack surface-this is not a remotely exploitable, unauthenticated issue. The SSVC decision framework would likely assign a 'low' exploitation priority due to the privilege requirement and limited impact.

An attacker who has already gained administrative credentials on the adjacent network accesses the configuration management interface of an unpatched PCC system. By sending crafted requests or observing response differences, the attacker enumerates valid usernames, which could be used to stage a broader attack against other services or accounts.