CVE-2026-25658 HIGH

CVE-2026-25658: Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability

Vendor Ericsson

Product Packet Core Gateway (PCG)

Weakness CWE-230

Published June 5, 2026

Last update June 5, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

Key dates

02Disclosure timeline

June 5, 2026 CVE published

June 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25658 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/230.html

Related vulnerabilities

04Related CVE

CVE-2025-23225 IBM MQ denial of service CVE-2026-25659 Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability CVE-2024-10508 RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset CVE-2026-1461 Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values