The vulnerability is a CWE‑497 exposure of sensitive system information in the configuration management component of Ericsson Packet Core Controller. An attacker who can interact with the configuration interface can enumerate other local users, revealing potentially identifying information. This does not allow code execution, but it increases the attack surface for credential gathering and lateral movement. Based on the description, it is inferred that the attacker must first gain access to the configuration interface, which may be protected by authentication or network segmentation.

Ericsson Packet Core Controller (PCC) releases prior to version 1.39 are affected. The vulnerability resides in the configuration management functionality common to all earlier builds.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% shows a very low exploitation probability, so deployment likelihood remains low. Based on the description, it is inferred that attackers must access the configuration interface to perform enumeration, and the likely attack vector is through a compromised configuration session or a misconfigured network service providing access to the interface. Attackers would need some level of access to PCC’s configuration management interface, which may be protected by network segmentation and authentication; if these controls are lax, enumeration could be performed over the local network or via remote management interfaces. No public exploit or proof‑of‑concept is documented, so the risk depends largely on the environment’s exposure of the configuration interface.