Ericsson Packet Core Gateway EUVD-2026-34823

Attacker must have adjacent-network access to a PCG signaling or user-plane interface (CVSS AV:A, not internet-routable) and must be able to continuously send the specially crafted message - a single packet is insufficient because impact only persists while the flood continues. No authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited to PCG versions prior to 1.30, and the impact is bounded to availability (VC:N/VI:N/VA:H) with automatic recovery on attack cessation, meaning the vulnerability cannot be used for code execution, data theft, or persistence.

The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H accurately frames this as a pure availability issue requiring no authentication and no user interaction, but only reachable from an adjacent network - not the open internet - which substantially narrows the realistic attacker population to those with operator-network footholds (insider, compromised peer, lawful-intercept-adjacent access, or a rogue device on the signaling fabric). There is no EPSS score, KEV listing, or public POC provided, so exploitation likelihood data is absent; the 7.1 score should be read as 'high impact within a constrained reachability envelope,' not as broadly exploitable. For a mobile operator, the impact is non-trivial since a sustained crash loop on PCG can degrade subscriber data sessions across a region, but the self-recovery behavior on attack cessation means this is service degradation rather than persistent compromise.

An attacker with access to the operator's internal signaling network - for example via a compromised adjacent network function, a misconfigured peering link, or an insider position - continuously transmits a crafted message with a required field omitted to a PCG ingress interface. The PCG process repeatedly crashes on the missing-value condition, dropping or refusing subscriber session signaling for the duration of the flood; the service recovers once the attacker stops, so the scenario is best understood as a sustained DoS rather than a one-shot kill.