Technical impact
The vulnerability is an improper handling of syntactically invalid structures (CWE-228) in Ericsson Packet Core Gateway (PCG). By continuously sending specially crafted messages, an attacker can trigger resource exhaustion or processing delays, resulting in a degradation of service that persists only while the attack continues. The system recovers after the attack stops, so the impact is a temporary denial of service rather than a crash or data loss.
Affected Systems
All Ericsson Packet Core Gateway (PCG) implementations with firmware versions earlier than 1.30 are affected.
Risk and Exploitability
The CVSS score of 7.1 indicates a moderate to high severity. With no EPSS data and no listing in the CISA KEV catalog, the likelihood of exploitation is uncertain. The likely attack vector is inferred from the description: an attacker must maintain continuous network access to send malformed protocol messages that trigger the improper handling. Because the attacker must maintain continuous traffic to sustain degradation, the window of opportunity requires persistent network access, yet the impact can be significant for network uptime.
