Packet Core Controller Pcc
Monthly
Directory traversal in Ericsson Packet Core Controller (PCC) Configuration Management allows authenticated attackers with high privileges to alter directory permissions, causing denial of service to legitimate users. The vulnerability affects PCC versions prior to 1.39 and requires adjacent network access. No public exploit or active exploitation (KEV) has been reported, and the CVSS 4.0 medium score (4.8) reflects the limited impact and prerequisites.
Hardcoded credential in Ericsson Packet Core Controller (PCC) versions before 1.38 allows an attacker with cluster access to read alarm and alert information
Information disclosure vulnerability in Ericsson Packet Core Controller (PCC) versions before 1.39 permits an attacker with high privileges on an adjacent network to enumerate system users through the configuration management interface. No evidence of active exploitation or public exploit code has been identified at this time, and the CVSS score of 4.8 (Medium) reflects the requirement for elevated privileges and adjacent access.
Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.
Directory traversal in Ericsson Packet Core Controller (PCC) Configuration Management allows authenticated attackers with high privileges to alter directory permissions, causing denial of service to legitimate users. The vulnerability affects PCC versions prior to 1.39 and requires adjacent network access. No public exploit or active exploitation (KEV) has been reported, and the CVSS 4.0 medium score (4.8) reflects the limited impact and prerequisites.
Hardcoded credential in Ericsson Packet Core Controller (PCC) versions before 1.38 allows an attacker with cluster access to read alarm and alert information
Information disclosure vulnerability in Ericsson Packet Core Controller (PCC) versions before 1.39 permits an attacker with high privileges on an adjacent network to enumerate system users through the configuration management interface. No evidence of active exploitation or public exploit code has been identified at this time, and the CVSS score of 4.8 (Medium) reflects the requirement for elevated privileges and adjacent access.
Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.