This vulnerability (CVE-2025-59172) affects Ericsson Packet Core Controller (PCC) versions before 1.38. It is classified as CWE-78, indicating improper neutralization of special elements used in an OS command, commonly known as OS command injection. An attacker with high privileges on the system can exploit this flaw to execute arbitrary code with root-level permissions. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and high impact on all security properties. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation allows an attacker with high privileges to execute arbitrary code as root on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. Since the attacker requires high privileges and adjacent network access, the attack surface is somewhat limited but still serious in environments where such access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system to trusted administrators only and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks. Follow Ericsson's official communications for updates on patches or workarounds.