The vulnerability is an Improper Handling of Missing Values that allows an attacker to send a specially crafted message repeatedly to an Ericsson Packet Core Gateway (PCG) system. Repeated attacks lead to service degradation or crashes, and the impact persists only while the attack continues; when the attacker stops, the system recovers automatically. The weakness is classified as CWE‑230 and results in a denial‑of‑service type of failure rather than a compromise of confidentiality or integrity.

The affected product is Ericsson Packet Core Gateway (PCG) versions prior to 1.30. Any installation using a version older than 1.30 is vulnerable.

The CVSS base score of 7.1 indicates moderate to high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Inference shows that the likely attack vector is remote, over the network, by continuously injecting crafted messages into the PCG traffic flow. Since the system can recover after the attacker stops, the primary threat is sustained denial of service, making this a high operational risk for operators unable to mitigate traffic or update promptly.