CVE-2026-25657: Ericsson Packet Core Gateway Denial-of-Service Vulnerability (PCG < 1.30)

Technical summary

CVE-2026-25657 is an Improper Handling of Syntactically Invalid Structure flaw (CWE-228) in Ericsson PCG that permits denial of service via crafted message payloads. The vulnerability resides in the packet core gateway's message parsing logic, which fails to properly validate or sanitize incoming structures. Continuous transmission of these messages causes repeated crashes or severe degradation. Recovery occurs naturally when the attack ceases, indicating no persistent system corruption. The attack vector requires adjacent network access (AV:A), involves no special privileges (PR:N), and requires no user interaction (UI:N).

Business impact

Service interruptions to packet core gateway functions directly impact mobile network operations. If PCG handles critical packet routing, authentication, or policy enforcement in your telecom infrastructure, repeated denial-of-service attacks would disrupt subscriber connectivity and revenue-generating services. The intermittent nature—recover-after-attack-stops—means impact is operational rather than data-breaching, but availability SLAs and customer satisfaction are at stake. For carriers or large enterprises with PCG deployments, this warrants prioritization in environments exposed to untrusted adjacent networks.

Affected systems

Ericsson Packet Core Gateway versions prior to 1.30 are vulnerable. Check your deployed version immediately. The attack requires adjacent network access, so exposure depends on your network architecture: systems on isolated or tightly segmented networks have lower risk than those exposed to untrusted VLANs, partner networks, or cloud environments where adjacent-network threats are realistic.

Exploitability

Exploitation is straightforward from a technical perspective—an attacker needs only to craft and repeatedly send a malformed message. No authentication, privilege escalation, or complex social engineering is required. The barrier to entry is low if the attacker has network proximity. However, the CVSS score of 6.5 reflects that impact is availability-only (no confidentiality or integrity breach) and adjacency is required. This is not a trivial vulnerability for exposed systems, but less critical than remote code execution or data exfiltration scenarios.

Remediation

Upgrade Ericsson PCG to version 1.30 or later. This is the definitive remediation. If immediate patching is not feasible, implement network segmentation to restrict access to PCG from untrusted or external networks. Monitor for abnormal traffic patterns or repeated malformed messages directed at PCG. Consider isolating PCG to a management or internal-only network segment if business operations permit.

Patch guidance

Contact Ericsson support or consult the official Ericsson security advisory for PCG 1.30+ download and deployment steps. Verify patch version numbers directly from Ericsson's advisory before deployment. Plan patching during maintenance windows to minimize service disruption, particularly if your PCG instances are load-balanced or in active/standby configurations. Test the patched version in a non-production environment first, especially if you run custom configurations or third-party integrations with PCG.

Detection guidance

Monitor PCG logs for parsing errors, syntax validation failures, or repeated crash cycles that correspond with no clear traffic anomalies. Inspect network traffic for unusual packet structures or patterns targeting PCG ports. Implement IDS/IPS rules to detect and block known malformed message patterns if Ericsson publishes indicators. Baseline normal PCG behavior (CPU, memory, restart events) and alert on deviations. If you observe periodic availability spikes with spontaneous recovery, investigate whether an attack is in progress.

Why prioritize this

Although the CVSS score is medium (6.5), PCG is critical infrastructure in telecom networks. Denial-of-service attacks on core gateway functions can cascade, affecting millions of subscribers. The low barrier to exploitation from adjacent networks and the simplicity of the attack vector mean this should be prioritized for patching in production environments, especially if PCG is exposed to partner networks, cloud interconnects, or less-trusted segments. Non-production or fully isolated systems can be addressed with lower urgency.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects availability impact only (no confidentiality or integrity loss), adjacency-level access requirement (AV:A), and lack of privilege or user interaction needs. The score would be higher if the vulnerability allowed remote access or data exfiltration. It is not marked as critical, but criticality in practice depends on your network topology and PCG's role in your infrastructure. A patch is available and should be applied promptly to production deployments.

Frequently asked questions