CVE-2025-59180 is a vulnerability in Ericsson Packet Core Controller (PCC) versions before 1.38 where hardcoded credentials exist in the alarm system. An attacker who has access to the cluster and knows these credentials can read sensitive alarm and alert information. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with cluster access and knowledge of the hardcoded credentials can read alarm and alert information, potentially exposing sensitive operational data. The vulnerability does not require user interaction or privileges and has low complexity for exploitation but requires local access to the cluster. The impact is limited to information disclosure within the alarm system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the cluster to trusted personnel only and monitor for unauthorized access attempts. Avoid sharing or exposing cluster credentials and consider additional access controls around the alarm system.