PT-2026-21578 · Free5Gc · Free5Gc Udm

Published 2026-02-23 · Updated 2026-03-01 · CVE-2025-69250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions free5gc UDM versions up to and including 1.4.1

Description The UDM component of free5gc, used for Unified Data Management in 5G mobile core networks, discloses detailed internal error messages to remote clients when processing invalid pduSessionId inputs. This exposure of implementation details can be used for service fingerprinting. All deployments utilizing the UDM Nudm UECM DELETE service may be affected.

Recommendations Apply the patch available in free5gc/udm pull request 76.

Exploit

Fix

Improper Check for Exceptional Conditions

RCE

Weakness Enumeration

CWE-754

CWE-20

Related Identifiers

CVE-2025-69250

GHSA-6W77-5PQH-83RM

Affected Products

Free5Gc Udm

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69250.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-6w77-5pqh-83rm · Vendor Advisory
• https://github.com/free5gc/free5gc/issues/750 · Vendor Advisory
• https://github.com/free5gc/udm/commit/504b14458d156558b3c0ade7107b86b3d5e72998 · Patch
• https://github.com/free5gc/udm/pull/76 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-69250 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69250 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026184669549789413 · Twitter Post
• https://twitter.com/cracbot/status/2027338124238745873 · Twitter Post
• https://twitter.com/cracbot/status/2028062737155465629 · Twitter Post
• https://twitter.com/CVEarity/status/2026156629117546603 · Twitter Post
• https://t.me/cveNotify/153184 · Telegram Post
• https://twitter.com/cracbot/status/2027700423440929093 · Twitter Post
• https://t.me/cveNotify/152943 · Telegram Post