CVE-2026-25659: Ericsson Packet Core Gateway DoS Vulnerability Analysis

Technical summary

CVE-2026-25659 is an improper handling of missing values (CWE-230) in Ericsson PCG prior to version 1.30. The flaw exists in message processing logic that fails to validate or handle certain missing fields in incoming packets. When an attacker sends specially crafted messages lacking expected values, the gateway enters a degraded state, consuming resources or entering error loops. The vulnerability requires network adjacency (AV:A) and no authentication, making it exploitable by any actor on the same local network segment. The system does not suffer permanent compromise and restarts recovery once malicious traffic ceases.

Business impact

Service availability is the primary concern. PCG handles packet gateway functions critical to mobile network operations. An active attack causes temporary but disruptive service degradation, affecting call routing, data session establishment, or packet forwarding depending on PCG's role in your architecture. Unlike corruption or data theft, the impact is operational—users experience connection delays or failures. Recovery is automatic, reducing incident response overhead, but repeated attacks create operational friction and potential SLA violations. The local network requirement limits exposure in well-segmented environments but increases risk in enterprises with permissive internal network trust models.

Affected systems

Ericsson Packet Core Gateway versions prior to 1.30 are vulnerable. Verify your deployed version against vendor documentation. Later versions (1.30 and beyond) are not affected. This vulnerability does not impact other Ericsson products or competing gateway platforms. Assess your PCG footprint across central office, regional, and distributed deployments.

Exploitability

Exploitability is straightforward but requires network positioning. An attacker must be on the same local network segment (AV:A) as the PCG—either an internal threat actor or someone with lateral access following a perimeter compromise. No authentication, special privileges, or user interaction is needed; the attack is fully automated. Attack complexity is low (AC:L), meaning a standard crafted packet is sufficient; no race conditions or timing exploitation is required. The barrier to exploitation is low for insiders or compromised internal systems, moderate for external attackers in environments without network segmentation.

Remediation

Upgrade Ericsson PCG to version 1.30 or later. This is a straightforward patch remediation with no known workarounds for earlier versions. Coordinate with Ericsson and your network operations team to schedule upgrades, accounting for change windows and redundancy requirements. Pending patching, implement network segmentation to restrict access to PCG management and control interfaces to trusted administrative networks only. Monitor for unusual packet patterns or message formats targeting PCG.

Patch guidance

Contact Ericsson to obtain version 1.30 or later through your standard support channels. Verify patch availability and compatibility with your current PCG configuration, licensing, and dependent systems. Test the upgrade in a staging environment first, particularly if you rely on PCG for critical call routing or data sessions. Plan for minimal service interruption by leveraging redundancy or scheduled maintenance windows. Confirm version after deployment using Ericsson diagnostics or system information commands.

Detection guidance

Monitor PCG logs and metrics for unusual message rejection rates, processing errors, or CPU/memory spikes correlating with inbound packet bursts. Network detection should focus on identifying malformed or incomplete packets with missing expected header fields destined for PCG ports. Establish baseline metrics for normal PCG load and alert on deviations. If available, enable PCG debug logging to capture packet details during suspected attacks. Correlation with network segmentation logs may reveal lateral movement from compromised internal systems.

Why prioritize this

This vulnerability merits medium-priority attention. It requires network adjacency, limiting broad internet exposure, but affects core infrastructure (packet gateway) in telecom or enterprise mobile network environments. The denial-of-service impact is disruptive but temporary and recoverable, reducing post-incident severity compared to data breach or permanent system compromise. Organizations with strict network segmentation can justify a longer timeline; those with flat internal networks or critical mobile dependencies should prioritize patching sooner. The CVSS 6.5 MEDIUM score reflects high availability impact (A:H) constrained by local network requirement.

Risk score, explained

The CVSS 3.1 score of 6.5 MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a localized but operationally significant vulnerability. Attack Vector (AV:A) limits scope to the local network, preventing remote exploitation. Attack Complexity (AC:L) and lack of privilege or user interaction (PR:N, UI:N) indicate a straightforward, automated attack. Confidentiality and Integrity are not impacted (C:N, I:N), ruling out data compromise. Availability impact is high (A:H) due to service degradation. The score appropriately weights operational disruption against the network adjacency requirement.

Frequently asked questions