Quick answers
- Is CVE-2025-59178 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-59178 being exploited in the wild.
- How severe is CVE-2025-59178?
- Informational severity, with a CVSS score of 4.8, published 27 July 2026.
- Which products and versions are affected?
- Ericsson Packet Core Controller versions prior to 1.39.
- Is there a fix for CVE-2025-59178?
- A patch was published on 1.39: Vulnerability fixed in version 1.39. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-59178 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2025-59178?
- Check whether you run Ericsson Packet Core Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An exposure of sensitive system information vulnerability (CWE-497) exists within the Configuration Management component of Ericsson Packet Core Controller (PCC). The flaw allows an authenticated attacker with high privileges (PR:H) to enumerate other system users. The attack vector is restricted to the adjacent network (AV:A), such as the local management network. This information disclosure can be leveraged for further reconnaissance or targeted credential attacks. The issue is resolved in PCC version 1.39.
Affected products
- Ericsson Packet Core Controller (PCC) versions prior to 1.39
Timeline
- 2026-07-27: advisory: NVD and Ericsson published the vulnerability details.
- 1.39: patched: Vulnerability fixed in version 1.39.