PT-2021-24241 · Open5Gs · Open5Gs

Salim S.I · Published 2021-12-23 · Updated 2023-09-25 · CVE-2021-45462

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: Open5GS version 2.4.0

Description: A crafted packet from a UE can cause a crash in the SGW-U/UPF component. This issue can potentially be used to deploy a denial-of-service (DoS) attack on private 5G networks.

Recommendations: For Open5GS version 2.4.0, consider implementing packet validation and filtering to prevent malicious packets from reaching the SGW-U/UPF component. As a temporary workaround, restrict access to the SGW-U/UPF component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2021-45462

Affected Products

Open5Gs

References · 5

• https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700 · Patch
• https://osv.dev/vulnerability/CVE-2021-45462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45462 · Security Note
• https://trendmicro.com/en_us/research/23/i/attacks-on-5g-infrastructure-from-users-devices.html · Note
• https://twitter.com/TrendKon/status/1704423712093774011 · Twitter Post