CVE-2025-59174: Ericsson Packet Core Controller Denial-of-Service Vulnerability (v1.39 Patch)

Technical summary

CVE-2025-59174 is a denial-of-service flaw in Ericsson PCC that stems from improper handling of crafted network messages (CWE-228: Improper Handling of Missing Values). The vulnerability allows unauthenticated, adjacent-network attackers to exhaust system resources or crash services by flooding the controller with specially constructed packets. The attack requires network-layer access (AV:A) rather than remote internet access, but bypasses authentication controls (PR:N) and requires no user interaction (UI:N). The impact is strictly availability-focused; no data confidentiality or integrity is affected.

Business impact

Degradation or outage of Packet Core Controller services can directly impact mobile network packet routing, call control, and session management. In a telecom environment, this translates to dropped calls, interrupted data sessions, and potential revenue loss during the attack window. Organizations operating legacy Ericsson PCC infrastructure should consider the operational criticality of affected instances and the prevalence of attackers with adjacent network access in their threat model.

Affected systems

Ericsson Packet Core Controller versions before 1.39 are vulnerable. Operators running PCC in production environments should inventory their deployment versions immediately. Earlier versions including 1.38 and below are in scope; verify your specific version against Ericsson's advisory to confirm exposure.

Exploitability

The attack has low complexity and no authentication requirement, but is constrained to adjacent network segments (same LAN or directly connected networks). It is not remotely exploitable from the general internet. In datacenter or managed network environments where adjacent-network access is tightly controlled, practical exploitability is lower. In less-segmented deployments or where untrusted devices share the same network segment as PCC, risk increases significantly. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Ericsson Packet Core Controller to version 1.39 or later. This is the only available mitigation; no workarounds or interim patches are documented. Plan upgrades during maintenance windows to minimize service disruption. Before deploying, verify compatibility with your broader Ericsson stack and test in a staging environment. If immediate patching is not feasible, implement network segmentation to restrict access to PCC management and data interfaces only to trusted administrative and peer systems.

Patch guidance

Obtain the PCC 1.39 release or later directly from Ericsson's customer portal or support team. Verify the patch version signature and integrity before deployment. Ericsson typically provides detailed upgrade procedures and rollback guidance with each release; follow their documented change management process. Test failover and redundancy scenarios post-upgrade if PCC is deployed in a high-availability configuration. Plan for potential service interruption during the upgrade window.

Detection guidance

Monitor for unusual message volumes or malformed packet patterns targeting Packet Core Controller interfaces. Intrusion detection systems and NetFlow analysis can help identify flooding patterns from adjacent network segments. Review PCC logs for repeated session resets, resource exhaustion warnings, or service crashes correlating with inbound traffic spikes. Implement rate-limiting or traffic shaping on upstream network devices to reduce the blast radius of potential flooding attacks.

Why prioritize this

Although rated MEDIUM severity, this vulnerability directly impacts critical telecom infrastructure. The low barrier to attack (no authentication) and the functional impact on call and data session handling make it worthy of rapid remediation, especially if your PCC instances are exposed to untrusted adjacent networks or shared datacenter environments. The lack of current public exploitation should not delay patching.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the high availability impact (A:H) but is lowered by the constraint that the attacker must already have adjacent-network access (AV:A). The score does not account for business context; a telecom operator's dependence on PCC availability and their network segmentation posture will drive actual organizational risk higher or lower than the base score.

Frequently asked questions