This vulnerability (CVE-2025-59178) affects Ericsson Packet Core Controller (PCC) versions before 1.39. It is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. Specifically, the flaw allows an attacker with high privileges to enumerate other users on the system via configuration management interfaces. The CVSS 4.0 base score is 4.8 (medium severity), with attack vector being adjacent network, low attack complexity, no user interaction, and requiring high privileges. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

An attacker with high privileges on the adjacent network can enumerate other users on the system, potentially aiding further reconnaissance or privilege escalation efforts. The exposure is limited to sensitive system information related to user enumeration and does not directly allow for system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to configuration management interfaces to trusted administrators only and monitor for unusual user enumeration activities. No official remediation or temporary fix has been published by Ericsson as of now.