Is CVE-2025-59177 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59177 being exploited in the wild.

How severe is CVE-2025-59177?

Informational severity, with a CVSS score of 6.8, published 27 July 2026.

Which products and versions are affected?

Ericsson Packet Core Controller versions prior to 1.39.

Is there a fix for CVE-2025-59177?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-59177 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2025-59177?

Check whether you run Ericsson Packet Core Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59177: Ericsson Packet Core Controller information disclosure in Configuration Management

CVE-2025-59177 · Severity: info · CVSS 6.8 · Published 2026-07-27

Ericsson Packet Core Controller, a critical component in mobile network infrastructure, contains a security flaw in its configuration management system. An attacker with high-level administrative access could use specially crafted commands to force the system to reveal sensitive internal secrets through error messages. This could lead to the exposure of credentials or other confidential system data, potentially compromising the security of the mobile core network.

Technologies: Ericsson Packet Core Controller. Vendors: Ericsson.

Quick answers

Is CVE-2025-59177 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59177 being exploited in the wild.
How severe is CVE-2025-59177?: Informational severity, with a CVSS score of 6.8, published 27 July 2026.
Which products and versions are affected?: Ericsson Packet Core Controller versions prior to 1.39.
Is there a fix for CVE-2025-59177?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59177 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-59177?: Check whether you run Ericsson Packet Core Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sensitive information disclosure vulnerability (CWE-209) exists in the Configuration Management component of Ericsson Packet Core Controller (PCC). The flaw allows an authenticated attacker with high privileges (PR:H) to execute crafted commands that trigger error messages containing system secrets. The attack vector is restricted to the adjacent network (AV:A). This vulnerability could be used to extract sensitive configuration data or credentials. The issue is resolved in Ericsson PCC version 1.39.

Affected products

Ericsson Packet Core Controller (PCC) versions prior to 1.39

Timeline

2026-07-27: advisory: NVD publication date
2026-07-27: disclosed: Initial disclosure by Ericsson

References

https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.