What is the CVSS score of CVE-2023-36998?

CVE-2023-36998 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2023-36998?

Within 30 days: Identify all affected systems and apply vendor patches as part of regular patch cycle. If patching is delayed, consider network segmentation to limit exposure.

CVE-2023-36998

HIGH

Stack-based Buffer Overflow (CWE-121)

2025-01-22 cve@mitre.org

Stack Overflow Buffer Overflow

8.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.9 HIGH

AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:05 vuln.today

CVE Published

Jan 22, 2025 - 15:15 nvd

HIGH 8.9

DescriptionCVE.org

The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-121. The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.