Security readout for executives and security teams
Plain-English summary
Ericsson Packet Core Controller versions before 1.39 can allow a highly privileged, network-adjacent attacker to enumerate other system users through Configuration Management. This exposes sensitive system information that could support further targeting, but the supplied evidence indicates limited impact and no availability loss.
Executive priority
Schedule remediation through normal vulnerability-management timelines, prioritizing exposed management environments and deployments with broadly assigned privileged access. Escalate if monitoring identifies suspicious enumeration or unauthorized administrative activity. The supplied evidence does not justify emergency, organization-wide disruption.
Technical view
CVE-2025-59178 is a CWE-497 information-exposure flaw in PCC Configuration Management. CVSS 4.0 scores it 4.8: adjacent-network access, low complexity, high privileges, and no user interaction. The vector records low vulnerable-system confidentiality and integrity impacts, with no availability or downstream-system impact.
Likely exposure
Exposure is limited to Ericsson PCC deployments running versions before 1.39. Exploitation requires adjacent-network access and high privileges, reducing broad internet risk. The bundle does not identify particular configurations, interfaces, or deployment patterns that increase exposure.
Exploitation context
The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or public weaponization. An attacker could enumerate other users, potentially improving knowledge of accounts and system structure. No further exploit capability is established.
Researcher notes
The supplied affected-product metadata contains an ambiguous version entry of "0" and a default status of unaffected, while the description explicitly identifies versions before 1.39. Validate exact applicability against Ericsson's bulletin. No affected configuration details, indicators of compromise, or exploitation evidence are supplied.
Mitigation direction
- Inventory Ericsson PCC deployments and identify versions earlier than 1.39.
- Review Ericsson's security bulletin for the approved remediation and deployment requirements.
- Upgrade affected systems to version 1.39 or later following Ericsson guidance.
- Restrict Configuration Management access to authorized administrative networks and personnel.
Validation and detection
- Confirm each PCC instance reports version 1.39 or later.
- Verify Configuration Management is unreachable from untrusted or non-administrative network segments.
- Review privileged-account and Configuration Management logs for unexpected user-enumeration activity.
- Confirm access controls permit only required administrators and service accounts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-497: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-59178 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N——ERICVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026CVE reference, ERIC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.