CVE-2025-59180

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.

CVSS

No CVSS.

References

Link	Resource
https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026

Configurations

No configuration.

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Versiones de Ericsson Packet Core Controller (PCC) anteriores a la 1.38 contienen una vulnerabilidad de credenciales codificadas en el sistema de alarmas. Un atacante con acceso al clúster y conocimiento de la credencial codificada puede leer información de alarmas y alertas.

Information

Published : 2026-07-27 15:16

Updated : 2026-09-29 19:10

NVD link : CVE-2025-59180

Mitre link : CVE-2025-59180

CVE.ORG link : CVE-2025-59180

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-59180", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59180", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T15:08:08.319671Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "affectedData": [{"vendor": "Ericsson", "product": "Packet Core Controller (PCC)", "versions": [{"status": "affected", "changes": [{"at": "1.38", "status": "unaffected"}], "version": "0", "lessThan": "1.38", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T15:16:46.170", "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information."}, {"lang": "es", "value": "Versiones de Ericsson Packet Core Controller (PCC) anteriores a la 1.38 contienen una vulnerabilidad de credenciales codificadas en el sistema de alarmas. Un atacante con acceso al cl\u00faster y conocimiento de la credencial codificada puede leer informaci\u00f3n de alarmas y alertas."}], "lastModified": "2026-09-29T19:10:00.160", "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}