PT-2025-1395 · Open5Gs · Open5Gs Mme

Published 2024-02-02 · Updated 2025-01-23 · CVE-2023-37003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Open5GS MME versions prior to 2.6.4

Description The issue allows an attacker to send a malformed ASN.1 packet over the S1AP interface, triggering an assertion that can cause the MME to crash repeatedly, resulting in denial of service. This can be achieved by sending an E-RAB Setup Response message without the required MME UE S1AP ID field.

Recommendations For versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the S1AP interface to minimize the risk of exploitation. Avoid processing E-RAB Setup Response messages missing the MME UE S1AP ID field until the issue is resolved.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2025-13319

CVE-2023-37003

Affected Products

Open5Gs Mme

References · 7

• 🔥 https://cellularsecurity.org/ransacked · Exploit
• https://osv.dev/vulnerability/CVE-2023-37003 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13319 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37003 · Security Note
• https://github.com/open5gs/open5gs/pull/2942 · Note
• https://vuldb.com/?id.292958 · Note
• https://twitter.com/CVEnew/status/1882300202033307720 · Twitter Post