PT-2026-64918 · Ericsson · Packet Core Controller

Spark Nz · CVE-2025-59180 · Published 2026-07-27 · Updated 2026-07-27

NVD

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-59180

Affected Products

Packet Core Controller

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2025-59180 · Security Note
• https://ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026 · Note