Technical impact
The vulnerability is an improper handling of missing values that allows an attacker to send a specially crafted message to the Ericsson Packet Core Gateway; continuous sends cause the gateway to degrade service temporarily. While the gateway does not crash permanently, the interruption persists as long as the malicious traffic continues, resulting in degraded performance for legitimate traffic.
Affected Systems
Vulnerable versions are all releases of Ericsson Packet Core Gateway earlier than 1.30. Organizations using those versions should verify their deployment and plan to update to 1.30 or later. No specific patch details are publicly listed, but the vendor indicates that versions below 1.30 are affected.
Risk and Exploitability
The CVSS score of 7.1 classifies this as a high severity issue, and although EPSS data is missing, the lack of vulnerability may still allow attackers to monetize continuous service disruption. The vulnerability is not currently listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Attackers would need to repeatedly send crafted traffic over the network to the PCG; the likely vector is the external radio access network interface, which implies that network-level access can trigger degradation.
