CVE-2025-59177 is a medium severity vulnerability (CVSS 6.8) affecting Ericsson Packet Core Controller (PCC) versions before 1.39. The vulnerability is classified as CWE-209, involving the generation of error messages that disclose sensitive information. An attacker with high privileges can execute specially crafted commands that trigger error messages revealing system secrets. The vulnerability does not require user interaction and has a low attack complexity. There is no indication of known exploits in the wild. No official patch or remediation level has been published yet, and no affected versions were explicitly stated beyond the version threshold 'prior to 1.39'.

The vulnerability allows an attacker with high privileges to obtain sensitive system information through error messages. This information disclosure could aid further attacks or system compromise. However, the attack requires high privileges, limiting the scope of exploitation. There is no evidence of remote exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Ericsson's advisories for updates. Until a patch is available, restrict access to the Configuration Management interface to trusted administrators only to reduce risk.