The flaw resides in the configuration management component of Ericsson Packet Core Controller (PCC) versions before 1.39. An attacker can send specially crafted configuration requests that cause the system to return detailed error messages containing internal secrets. Because the leakage is limited to error output, the vulnerability does not enable code execution but does expose confidential configuration data, making it a classic case of sensitive data exposure (CWE‑209).

All instances of Ericsson Packet Core Controller running any build earlier than version 1.39 are vulnerable. This includes every deployment of the PCC product family that has not applied the 1.39 release or later.

The CVSS score of 6.8 indicates a moderate risk level. The EPSS score of less than 1% shows that, as of now, exploitation is unlikely to be widespread, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an adversary with access to the configuration interface can issue crafted commands to trigger the error‑message disclosure; no local or privileged access is required by the description.