CVE-2026-25659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25659", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2026-02-04T12:41:54.869Z", "datePublished": "2026-06-05T11:08:39.929Z", "dateUpdated": "2026-06-05T20:11:23.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-06-05T11:08:39.929Z"}, "title": "Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-230", "description": "CWE-230 Improper handling of missing values", "type": "CWE"}]}], "affected": [{"vendor": "Ericsson", "product": "Packet Core Gateway (PCG)", "versions": [{"status": "affected", "version": "0", "lessThan": "1.30", "changes": [{"at": "1.30", "status": "unaffected"}], "versionType": "1.30"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Ericsson\nPacket Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling\nof Missing Values (CWE-230) vulnerability where an attacker continuously\nsending a specially crafted message can cause service degradation.\u00a0The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Ericsson\nPacket Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling\nof Missing Values (CWE-230) vulnerability where an attacker continuously\nsending a specially crafted message can cause service degradation.&nbsp;<span>The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.</span></p>"}]}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25659"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Clemens Keil, Manfred Heinz, Patrick Walker of BDO Cyber Security GmbH", "type": "finder"}, {"lang": "en", "value": "BSI 5G/6G Security Lab TEMIS (Federal Office for Information Security, Germany)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-05T20:11:16.225932Z", "id": "CVE-2026-25659", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T20:11:23.341Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25659", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2026-02-04T12:41:54.869Z", "datePublished": "2026-06-05T11:08:39.929Z", "dateUpdated": "2026-06-05T20:11:23.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-06-05T11:08:39.929Z"}, "title": "Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-230", "description": "CWE-230 Improper handling of missing values", "type": "CWE"}]}], "affected": [{"vendor": "Ericsson", "product": "Packet Core Gateway (PCG)", "versions": [{"status": "affected", "version": "0", "lessThan": "1.30", "changes": [{"at": "1.30", "status": "unaffected"}], "versionType": "1.30"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Ericsson\nPacket Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling\nof Missing Values (CWE-230) vulnerability where an attacker continuously\nsending a specially crafted message can cause service degradation.\u00a0The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Ericsson\nPacket Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling\nof Missing Values (CWE-230) vulnerability where an attacker continuously\nsending a specially crafted message can cause service degradation.&nbsp;<span>The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.</span></p>"}]}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25659"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Clemens Keil, Manfred Heinz, Patrick Walker of BDO Cyber Security GmbH", "type": "finder"}, {"lang": "en", "value": "BSI 5G/6G Security Lab TEMIS (Federal Office for Information Security, Germany)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25659", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-05T20:11:16.225932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T20:11:19.704Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Packet Core Gateway (PCG)", "vendor": "Ericsson", "versions": [{"changes": [{"at": "1.30", "status": "unaffected"}], "lessThan": "1.30", "status": "affected", "version": "0", "versionType": "1.30"}]}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ericsson:packet_core_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "A22CA693-31C9-4C56-B9F8-DF577769D499", "versionEndExcluding": "1.30", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ericsson\nPacket Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling\nof Missing Values (CWE-230) vulnerability where an attacker continuously\nsending a specially crafted message can cause service degradation.\u00a0The impact continues as long the attack persists but the system recovers from the crashes when the attack stops."}, {"lang": "es", "value": "Ericsson\nLas versiones de Packet Core Gateway (PCG) anteriores a la 1.30 contienen una vulnerabilidad de Manejo Inadecuado de Valores Faltantes (CWE-230) donde un atacante, al enviar continuamente un mensaje especialmente dise\u00f1ado, puede causar degradaci\u00f3n del servicio. El impacto contin\u00faa mientras el ataque persista, pero el sistema se recupera de las ca\u00eddas cuando el ataque cesa."}], "id": "CVE-2026-25659", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25659", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-05T20:11:16.225932Z", "version": "2.0.3"}}]}, "published": "2026-06-05T12:16:38.050", "references": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "tags": ["Vendor Advisory"], "url": "https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25659"}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-230"}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.30)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[1.30,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Packet Core Gateway (PCG)", "source": "cna", "vendor": "Ericsson"}, "product": "packet_core_gateway_(pcg)", "vendor": "ericsson"}], "created": "2026-06-05T13:30:36.147115+00:00", "updated": "2026-06-07T11:16:59.114683+00:00", "vendors": ["ericsson", "ericsson$PRODUCT$packet_core_gateway_(pcg)"]}