PT-2025-1414 · Open5Gs · Open5Gs

Published 2025-01-22 · Updated 2025-01-27 · CVE-2023-37022

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS MME versions <= 2.6.4

Description The issue is related to a reachable assertion in the UE Context Release Request packet handler. A packet containing an invalid MME UE S1AP ID field causes Open5GS to crash. An attacker may repeatedly send such packets to cause denial of service.

Recommendations For Open5GS MME versions <= 2.6.4, consider updating to a version greater than 2.6.4 to resolve the issue. As a temporary workaround, restrict access to the UE Context Release Request packet handler to minimize the risk of exploitation. Avoid sending packets with invalid MME UE S1AP ID fields to prevent denial of service.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2023-37022

Affected Products

Open5Gs

References · 5

• 🔥 https://cellularsecurity.org/ransacked · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37022 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37022 · Vendor Advisory
• https://twitter.com/cracbot/status/1883763030099685502 · Twitter Post
• https://twitter.com/CVEnew/status/1882300217233437159 · Twitter Post