Which versions of Ericsson Packet Core Gateway are affected by CVE-2026-25657?

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 are vulnerable to denial-of-service attacks triggered by malformed messages from adjacent networks, enabling attackers to repeatedly degrade…. A patch is available.

How to fix or mitigate CVE-2026-25657?

Within 24 hours: Inventory all Ericsson PCG deployments, identify versions below 1.30, and assess network exposure to adjacent networks. Within 7 days: Deploy network segmentation controls restricting PCG access from untrusted adjacent networks, enable inbound message validation logging, and configure alerting for unexpected gateway restart events. Within 30 days: Monitor Ericsson security advisories for version 1.30+ patch release, plan phased upgrade timeline coordinated with maintenance windows, and validate all interim controls remain effective.

Ericsson Packet Core Gateway CVE-2026-25657

Q: What is the CVSS score of CVE-2026-25657?

CVE-2026-25657 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34821 HIGH

Improper Handling of Syntactically Invalid Structure (CWE-228)

2026-06-05 ERIC

GHSA-jvw3-jcj6-6qc7

Ericsson Denial Of Service

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 13:01 EUVD

Analysis Generated

Jun 05, 2026 - 12:27 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

7.1 (HIGH)

DescriptionCVE.org

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

AnalysisAI

Denial of service in Ericsson Packet Core Gateway (PCG) versions prior to 1.30 allows an adjacent-network attacker to degrade service by continuously transmitting malformed messages that the gateway fails to parse safely. The condition causes recurring crashes that persist only while the attack is active, with automatic recovery once it stops, and no public exploit identified at time of analysis.

Technical ContextAI

Ericsson PCG is a 5G core network function combining SMF (Session Management Function) and UPF (User Plane Function) responsibilities, deployed by mobile operators to handle subscriber session management and user-plane packet forwarding. The flaw is rooted in CWE-228 (Improper Handling of Syntactically Invalid Structure), meaning a parser within the PCG's message-handling path does not gracefully reject malformed inputs and instead enters a fault state. The CPE cpe:2.3:a:ericsson:packet_core_gateway_(pcg) confirms the affected product is the PCG application itself, and the AV:A vector indicates the vulnerable interface is reachable from an adjacent network segment such as an operator's signaling or transport network rather than the public internet.

RemediationAI

Vendor-released patch: PCG version 1.30 - operators should upgrade to PCG 1.30 or later following Ericsson's standard core-network change management process, with details at https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25657. Until the upgrade window is available, compensating controls include restricting reachability to the PCG's signaling and management interfaces to known peer nodes only via ACLs at the transport layer, enabling rate-limiting or anomaly detection on signaling traffic to suppress repeated malformed messages, and tightening segmentation of the mobile core so that lateral access from less-trusted operator network zones is blocked; these controls reduce exposure but may add operational overhead, complicate legitimate inter-node communication during failover, and will not stop an attacker who already has a foothold inside a trusted peer.