CVE-2026-25657: Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure Vulnerability

Synopsis

An improper handling of syntactically invalid structure vulnerability affects Ericsson Packet Core Gateway (PCG) versions prior to 1.30. An unauthenticated attacker on an adjacent network can repeatedly send specially crafted malformed messages to the gateway, causing continuous service degradation for as long as the attack persists. The service recovers once the attack stops, but availability is fully disrupted during an active campaign. A patched-image rebuild at version 1.30 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (local network, LAN, or VPN segment) to reach the PCG service; remote internet-based exploitation is not possible with this vector.

• AuthenticationNot required

  No credentials or prior authentication are needed; any unauthenticated party on the adjacent network can send the malformed messages.

• Victim interactionNot required

  The attack is entirely attacker-driven and requires no action from a legitimate user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites are required beyond adjacency.

Blast Radius

• The targeted PCG service degrades or crashes continuously while the attack is in progress, disrupting all packet core gateway functions it handles.
• Legitimate network traffic processed by the PCG is dropped or delayed for the full duration of the attack.
• Service availability returns to normal once the attacker stops sending malformed messages, but no self-healing occurs during an active attack.