Which versions of Ericsson Packet Core Gateway are affected by CVE-2026-25658?

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 are vulnerable to denial-of-service attacks that allow adjacent network attackers to crash nodes repeatedly and degrade core network service…. A patch is available.

How to fix or mitigate CVE-2026-25658?

Within 24 hours: Identify all Ericsson PCG deployments, confirm versions, and document network topology showing which systems are accessible from adjacent network segments. Within 7 days: Deploy network segmentation and access controls to restrict PCG interface access; configure alerting for suspicious message patterns and repeated system restarts on affected nodes. Within 30 days: Upgrade to Ericsson PCG version 1.30 or later when released; conduct pre-production validation before production rollout.

Ericsson Packet Core Gateway CVE-2026-25658

Q: What is the CVSS score of CVE-2026-25658?

CVE-2026-25658 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34822 HIGH

Improper Handling of Missing Values (CWE-230)

2026-06-05 ERIC

GHSA-5p28-qfxx-wqm8

Ericsson Denial Of Service

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 13:01 EUVD

Analysis Generated

Jun 05, 2026 - 12:27 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

7.1 (HIGH)

DescriptionCVE.org

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

AnalysisAI

Denial of service in Ericsson Packet Core Gateway (PCG) versions prior to 1.30 allows adjacent network attackers to degrade service availability by continuously transmitting specially crafted messages that trigger improper handling of missing values (CWE-230). The affected PCG nodes crash repeatedly under sustained attack but self-recover once traffic stops, so impact is transient yet operationally significant for mobile core networks. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Packet Core Gateway is Ericsson's cloud-native 5G Core network function combining SMF and UPF roles, handling session management and user-plane forwarding for mobile subscribers. The root cause is CWE-230 (Improper Handling of Missing Values), meaning a protocol message parser fails to validate that expected fields are present before dereferencing or processing them, causing the handling process to crash. Because PCG terminates signaling and user-plane traffic from adjacent network elements (gNodeBs, AMFs, peer UPFs over N4/N3/N6 interfaces), a malformed message reaching the relevant parser is enough to disrupt subscriber sessions traversing that node. The CPE 'cpe:2.3:a:ericsson:packet_core_gateway_(pcg):*' covers all versions below the fixed 1.30 release.

RemediationAI

Upgrade Ericsson Packet Core Gateway to version 1.30 or later, which is the vendor-released patch that resolves CVE-2026-25658 per the Ericsson PSIRT advisory at https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25658. Where an immediate upgrade window is unavailable, operators should restrict adjacent-network reachability to the PCG by tightening ACLs on N2/N4/N3/Sx interfaces so that only authenticated peer NFs (AMF, SMF, gNodeB, peer UPFs) can send signaling, deploy signaling-firewall or GTP/PFCP inspection to drop malformed messages before they reach the gateway, and enable rate-limiting and anomaly alerting on the affected interfaces; these controls reduce exposure but can add latency and may block legitimate traffic from misconfigured peers, so they should be staged with monitoring. Ensure HA/redundancy and automatic process restart are configured so that the documented self-recovery behavior minimizes user-visible outage during any attempted exploitation.