Ericsson vulnerabilities and threats

CVE-2026-58107 is a medium severity vulnerability in Ericsson CodeChecker where the massStoreRun processing path decompresses attacker-controlled Base64-encoded zlib data without limiting the decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands significantly in memory, potentially exhausting process or host memory and disk space, causing denial of service.

CVE-2026-58106 is an out-of-bounds write vulnerability (CWE-787) in Ericsson CodeChecker through version 6.28.2. It occurs due to a stack overflow caused by the misuse of a bounded string copy function that writes 4096 bytes into a 4094-byte buffer, resulting in a 2-byte overflow on every invocation regardless of input length. The vulnerability has a low CVSS score of 2. No patch or official remediation has been confirmed yet.

CVE-2026-58108 is an improper access control vulnerability in Ericsson CodeChecker version 6.26.0. The flaw arises because a personal access token removal query filters on columns from a different table without a proper join, causing an implicit cross join. This allows a user to delete all personal access tokens in the system instead of only their own. The vulnerability has a low CVSS score of 1.2 and no known exploits in the wild.

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation.

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

CVE-2026-25660 is a critical authentication bypass vulnerability in Ericsson's CodeChecker tool, affecting versions through 6.27.3. The flaw allows an attacker to bypass authentication by manipulating the URL ending with 'Authentication' combined with certain function calls, enabling assignment of arbitrary permissions to any existing user. This vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2024-53828 is a medium severity vulnerability in Ericsson Packet Core Controller (PCC) versions prior to 1.38. The issue involves the potential for service degradation when an attacker sends a large volume of specially crafted messages. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. Patch status is not confirmed as no patch or vendor advisory is provided.

Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to unauthorized disclosure and modification of certain information.

Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized modification of certain information.

Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command. This issue affects CodeChecker: through 6.26.1.

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution.

Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege.