What is the CVSS score of CVE-2025-69252?

CVE-2025-69252 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Free5gc are affected by CVE-2025-69252?

CVE-2025-69252 affects free5GC UDM, a 5G core network component used by telecommunications and mobile infrastructure providers.. A patch is available.

Is there a public PoC exploit available for CVE-2025-69252?

Yes, a public proof-of-concept exploit is available for CVE-2025-69252. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-69252?

Within 24 hours: Inventory all free5GC UDM deployments and confirm versions; isolate affected systems from production if possible pending patch deployment. Within 7 days: Apply vendor patch to all UDM instances and conduct functional testing in staging environments before production rollout. Within 30 days: Complete patch deployment across all environments, validate through penetration testing, and document remediation in change management systems.

Free5gc CVE-2025-69252

HIGH

NULL Pointer Dereference (CWE-476)

2026-02-24 security-advisories@github.com

Denial Of Service Null Pointer Dereference Free5gc Udm

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 25, 2026 - 16:46 vuln.today

Public exploit code

Patch released

Feb 25, 2026 - 16:46 nvd

Patch available

CVE Published

Feb 24, 2026 - 00:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

AnalysisAI

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Affects Udm. free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected. free5gc/udm pull request 76 contains a fix for the i