CVE-2025-59172

HighCVSS 8.5/10Last modified Sep 29, 2026

Description

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
EricssonPacket Core Controller (PCC)< 1.38

References

Timeline

Published
Jul 27, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-591746.5Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially cCVE-2025-591776.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to exCVE-2025-591784.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in ConfiguratCVE-2025-59186.6A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentialCVE-2025-591805.1Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker wCVE-2025-591814.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that coCVE-2025-591845.5Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose iCVE-2025-591856.5External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.CVE-2025-591865.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-591877.8Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-591885.5Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose informationCVE-2025-591897.0Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.