VulnerabilityDeferred

CVE-2025-59172

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

HIGH 8.5EPSS 0.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: 85b1779b-6ecd-4f52-bcc5-73eac4659dcf

References

https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.