Ericsson Packet Core Gateway CVE-2026-25657

Attacker must have layer-2 or routed adjacent-network reachability (CVSS AV:A) to a PCG signaling or message-processing interface - this is not exploitable from the public internet and requires presence inside the operator's core or transport network or on a directly connected peer. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attacker must be able to continuously send the crafted malformed messages because impact ceases when the attack stops; exploitation is limited to availability impact only against PCG versions prior to 1.30, and the gateway self-recovers, so an attacker cannot achieve persistent outage without sustained traffic generation.

The CVSS 4.0 base score of 7.1 reflects an adjacent-network, low-complexity, unauthenticated attack (AV:A/AC:L/PR:N/UI:N) with high availability impact and no confidentiality or integrity impact (VC:N/VI:N/VA:H), which aligns with a pure denial-of-service profile. There is no EPSS score, no CISA KEV listing, and no public PoC identified, so the realistic risk is bounded by the adjacency requirement - an attacker must already have access to an internal mobile core or transport network, which significantly reduces exposure compared with internet-facing services. The description also notes that the system self-recovers once the attack ceases, meaning the impact is transient service degradation rather than permanent compromise, but for a telco core function even brief outages can cascade into mass subscriber service disruption, so operators with PCG in production should still treat this as a meaningful priority despite the limited threat-intel signals.

An attacker with a foothold on an adjacent network segment that can reach the PCG's signaling interface - for example, a compromised peer node, a rogue device in an operator's transport network, or an insider with lab access - sends a sustained stream of syntactically malformed protocol messages to the gateway. The PCG's parser repeatedly fails to handle the invalid structure, causing process crashes and degraded subscriber session handling for the duration of the flood, with service automatically restored once the attack stops; no public exploit identified at time of analysis.