CVE-2025-59178

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.

CVSS

No CVSS.

References

Link	Resource
https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026

Configurations

No configuration.

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Versiones de Ericsson Packet Core Controller (PCC) anteriores a la 1.39 contienen una vulnerabilidad de Exposición de Información Sensible del Sistema en la Gestión de Configuración, permitiendo a un atacante enumerar otros usuarios en el sistema.

Information

Published : 2026-07-27 15:16

Updated : 2026-09-29 19:10

NVD link : CVE-2025-59178

Mitre link : CVE-2025-59178

CVE.ORG link : CVE-2025-59178

JSON object : View

Products Affected

No product.

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2025-59178", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59178", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T15:05:49.022844Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "affectedData": [{"vendor": "Ericsson", "product": "Packet Core Controller (PCC)", "versions": [{"status": "affected", "changes": [{"at": "1.39", "status": "unaffected"}], "version": "0", "lessThan": "1.39", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T15:16:46.020", "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system."}, {"lang": "es", "value": "Versiones de Ericsson Packet Core Controller (PCC) anteriores a la 1.39 contienen una vulnerabilidad de Exposici\u00f3n de Informaci\u00f3n Sensible del Sistema en la Gesti\u00f3n de Configuraci\u00f3n, permitiendo a un atacante enumerar otros usuarios en el sistema."}], "lastModified": "2026-09-29T19:10:00.160", "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}