Spark Nz

**Name of the Vulnerable Software and Affected Versions** Ericsson Packet Core Controller (PCC) versions prior to 1.38 **Description** An Improper Neutralization of Special Elements issue allows an attacker to execute arbitrary code with root privileges. **Recommendations** Update Ericsson Packet Core Controller (PCC) to version 1.38 or later.

**Name of the Vulnerable Software and Affected Versions** Ericsson Packet Core Controller (PCC) versions prior to 1.39 **Description** A flaw in Configuration Management allows an attacker to execute specifically crafted commands, which can lead to the disclosure of system secrets via error messages. **Recommendations** Update to version 1.39 or later.

**Name of the Vulnerable Software and Affected Versions** Ericsson Packet Core Controller (PCC) versions prior to 1.39 **Description** An issue in Configuration Management leads to the exposure of sensitive system information, which allows an attacker to enumerate other users on the system. **Recommendations** Update to version 1.39 or later.

**Name of the Vulnerable Software and Affected Versions** Ericsson Packet Core Controller (PCC) versions prior to 1.38 **Description** The alarm system contains hardcoded credentials. An attacker with cluster access and knowledge of these credentials can read alarm and alert information. **Recommendations** Update to version 1.38 or later.

**Name of the Vulnerable Software and Affected Versions** Ericsson Packet Core Controller (PCC) versions prior to 1.39 **Description** A directory traversal issue exists in Configuration Management. This flaw allows an attacker to manipulate directory permissions, which can result in a denial of service by preventing legitimate users from accessing the system. **Recommendations** Update to version 1.39 or later.