PT-2026-21593 · Free5Gc · Free5Gc

Zfei10990-Cmd · Publicado 2026-02-24 · Atualizado 2026-02-25 · CVE-2026-27643

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.2

Description The free5GC UDR component, a user data repository for 5G mobile core networks, exhibits an information disclosure issue. The NEF component reveals internal parsing error details to remote clients, potentially aiding attackers in service fingerprinting. This affects all deployments of free5GC utilizing the Nnef PfdManagement service. The issue stems from the reliable leakage of parsing errors, such as invalid characters, to external entities.

Recommendations Apply the patch available in free5gc/udr pull request 56.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2026-27643

GHSA-6468-F87J-6G82

Produtos afetados

Free5Gc

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27643.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82 · Correção
• https://github.com/free5gc/free5gc/issues/753 · Aviso do Fabricante
• https://github.com/free5gc/udr/pull/56 · Correção
• https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4 · Correção
• https://t.me/cveNotify/153168 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27643 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2026187131442417665 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27643 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026184660401992093 · Publicação no Twitter