EUVD-2025-210514
GHSA-gpxc-m66h-466j
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (ERIC) · only source for this CVE.
CVSS VectorVendor: ERIC
Lifecycle Timeline
2DescriptionCVE.org
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.
AnalysisAI
Information disclosure vulnerability in Ericsson Packet Core Controller (PCC) versions before 1.39 permits an attacker with high privileges on an adjacent network to enumerate system users through the configuration management interface. No evidence of active exploitation or public exploit code has been identified at this time, and the CVSS score of 4.8 (Medium) reflects the requirement for elevated privileges and adjacent access.
Technical ContextAI
The Packet Core Controller (PCC) is a telecom network function used within Ericsson's mobile packet core infrastructure. The vulnerability resides in the configuration management component and is classified under CWE-497 (Exposure of Sensitive System Information). Per the CPE string cpe:2.3:a:ericsson:packet_core_controller_(pcc):*:*:*:*:*:*:*:*, all versions prior to 1.39 are affected. The root cause is improper access controls or information shielding in configuration management endpoints, allowing an authenticated user to infer the existence of other system accounts through responses or error messages.
RemediationAI
Upgrade to PCC version 1.39 or later as per the Ericsson security bulletin linked in the references. No workarounds have been published; as a compensating control, restrict network access to the configuration management interface to only trusted administrative hosts on the adjacent segment and enforce strict authentication and session management. Note that restricting access may impact legitimate management operations and should be tested in a staging environment.
More in Packet Core Controller Pcc
View allCommand injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege att
Hardcoded credential in Ericsson Packet Core Controller (PCC) versions before 1.38 allows an attacker with cluster acces
Directory traversal in Ericsson Packet Core Controller (PCC) Configuration Management allows authenticated attackers wit
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today