Tasnim Alam

**Name of the Vulnerable Software and Affected Versions** OpenAirInterface version 2.2.0 **Description** OpenAirInterface accepts Security Mode Complete without integrity protection. Although the configuration supports integrity NIA1 and NIA2, the system accepts and proceeds if a User Equipment (UE) sends an initial registration request with only security capability IA0. This security context downgrade can enable replay attacks, where a valid data transmission is maliciously or fraudulently repeated or delayed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.