Ericsson Packet Core Gateway CVE-2026-25658

Attacker must have layer-2/adjacent network reachability to a vulnerable Packet Core Gateway running a version below 1.30 (AV:A, not internet-exposed) and must be able to continuously send crafted protocol messages with omitted/missing fields to the PCG's signaling or user-plane interface. No authentication, no user interaction, and no special target configuration are required beyond running an unpatched PCG. Exploitation is limited by the need for adjacent-network access (typically a trusted telecom transport segment, peer NF, or compromised RAN element), and impact is bounded to availability that self-heals when the attack traffic ceases - there is no code execution, data disclosure, or persistence.

The CVSS 4.0 score of 7.1 reflects a focused availability-only impact: adjacent attack vector (AV:A) limits exposure to attackers already on the operator's signaling or transport network rather than the open internet, no privileges or user interaction are required (PR:N/UI:N), and only availability of the vulnerable component is affected (VA:H, with VC:N/VI:N and no subsequent-system impact). There is no EPSS score, no KEV listing, and no public POC referenced, so the practical exploitation likelihood appears low and tied to insider-or-compromised-peer threat models typical of telecom core networks. Because the system recovers when the attack stops and there is no confirmed RCE or data exposure, this is best treated as a high-priority availability/SLA risk for mobile operators rather than a critical breach risk - but for carriers, persistent PCG degradation can equate to broad subscriber outage, so it should not be deprioritized purely on the absence of exploit code.

An attacker with a foothold on the operator's transport or signaling network - for example via a compromised RAN element, a misconfigured peer NF, or a malicious roaming partner reachable on the adjacent network - repeatedly transmits a specially crafted message with required fields omitted to a PCG node. The PCG's parser fails to handle the missing values and crashes the processing component, and as long as the malformed traffic continues, subscriber session setup and user-plane forwarding through that node remain degraded; service is restored only when the attacker stops. No public POC is referenced, so an attacker would need to identify the specific malformed-message pattern through their own protocol research.