CVE-2026-25658: Ericsson Packet Core Gateway Availability Vulnerability (CWE-230)

Technical summary

CVE-2026-25658 is an Improper Handling of Missing Values vulnerability (CWE-230) in Ericsson Packet Core Gateway. The flaw allows an attacker on the network segment to repeatedly trigger service degradation through malformed messages that the PCG fails to validate or sanitize properly. The attack surface is limited to adjacent network positions (AV:A), requires no privileges or user involvement, and does not compromise confidentiality or integrity—only availability. System state recovers upon attack cessation, indicating the vulnerability does not cause permanent corruption.

Business impact

Service degradation on Packet Core Gateway infrastructure directly impacts mobile network operations. Affected operators experience intermittent service failures affecting subscribers on the compromised gateway. The reversible nature of the crash means recovery is automatic, but repeated attacks create operational overhead and potential revenue impact during active exploitation. Critical for mobile operators relying on uninterrupted packet routing and subscriber connectivity.

Affected systems

Ericsson Packet Core Gateway versions prior to 1.30 are vulnerable. Organizations running PCG deployments should confirm their current version against vendor documentation. The vulnerability is specific to this Ericsson product line and does not affect other packet gateway vendors unless explicitly cross-referenced in vendor advisories.

Exploitability

Exploitation requires network access to the PCG (adjacent network segment). No authentication, credentials, or user interaction are required. An attacker must craft specific malformed messages and send them continuously to maintain the degradation effect. The straightforward attack vector and lack of complexity make this exploitable by moderately skilled adversaries with network visibility to the gateway. However, the attack is not stealthy—continuous malicious traffic may be detectable through network monitoring.

Remediation

Upgrade Ericsson Packet Core Gateway to version 1.30 or later. Organizations should verify patch availability through official Ericsson security advisories and plan upgrades during maintenance windows. For environments unable to patch immediately, network-level access controls limiting connectivity to PCG interfaces and traffic filtering on gateway ports may reduce attack surface. Monitor vendor communications for any interim guidance or workarounds.

Patch guidance

Apply Ericsson Packet Core Gateway version 1.30 or later. Verify patch availability and compatibility with your network architecture before deployment. Test patched versions in staging environments to confirm stability and compatibility with dependent systems. Plan deployment during scheduled maintenance to minimize subscriber impact. Coordinate with Ericsson support if blockers or compatibility concerns arise.

Detection guidance

Monitor for sustained, malformed message traffic directed at PCG interfaces. Implement network-based detection on gateway ingress ports for patterns of irregular packets triggering service restarts. Log gateway crash events and correlate timing with suspicious traffic spikes. Alert on repeated restart cycles within short timeframes. Baseline normal PCG traffic to identify anomalous patterns; the attack requires continuous transmission, making it potentially visible on packet captures. Review gateway syslog and system event logs for CWE-230 related processing errors.

Why prioritize this

This is a MEDIUM-severity availability vulnerability with direct impact on mobile network operations. It requires network access (not internet-facing) and does not lead to data breach or system compromise, but repeated exploitation causes measurable service degradation. Prioritize patching in environments where the PCG is exposed to untrusted networks or where availability SLAs are critical. For isolated, tightly controlled PCG deployments, prioritize behind critical vulnerabilities but schedule patching in the near term.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) Attack Vector Adjacent—attacker must be on the same network segment; (2) Attack Complexity Low—no special conditions required; (3) Privileges None—no authentication needed; (4) User Interaction None—fully automated; (5) Availability High impact—service degrades while attack persists; (6) Confidentiality and Integrity None—no data compromise. The reversible crash nature and network-proximity requirement prevent a higher score, but the operational impact on telecom infrastructure warrants prompt remediation.

Frequently asked questions