PT-2025-21849 · O2 Uk · O2 Uk

Daniel Williams · Published 2025-05-18 · Updated 2025-05-19 · CVE-2025-48219

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: O2 UK through 2025-05-17

Description: The issue allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading the utran-cell-id-3gpp field of a "Cellular-Network-Info" SIP header, which might be usable to identify a cell location via crowdsourced data. This could potentially correspond to a small physical area, such as a city centre. The removal of the "Cellular-Network-Info" header is mentioned in section 4.4.19 of ETSI TS 124 229.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-48219

Affected Products

O2 Uk

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-48219 · Security Note
• https://twitter.com/OOVelma/status/1924427972632596725 · Twitter Post
• https://ispreview.co.uk/index.php/2025/05/o2-uk-fixes-volte-flaw-that-exposed-user-mobile-location-data.html · Note
• https://twitter.com/CVEnew/status/1924110863360770355 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1924131678840029271 · Twitter Post
• https://t.me/cvetracker/24157 · Telegram Post
• https://mastdatabase.co.uk/blog/2025/05/o2-expose-customer-location-call-4g · Note
• https://t.me/cvenotify/122821 · Telegram Post
• https://etsi.org/deliver/etsi_ts/124200_124299/124229/15.10.00_60/ts_124229v151000p.pdf · Note
• https://news.ycombinator.com/item?id=44014046 · Note