free5GC PCF EUVD-2026-32555

Requires network connectivity to the PCF Service-Based Interface (SBI), which listens on HTTP (typically TCP 8000) by default in free5GC deployments. The vulnerability exists in default configurations - no special features, non-default settings, or service enablement required. Exploitation succeeds against any free5GC PCF version below 1.4.3 where the SBI network is reachable by the attacker. In production 5G networks following 3GPP TS 33.501 security guidelines, PCF SBI should be isolated on a management network segment unreachable from external networks, significantly limiting real-world attack surface to insider threats or compromised adjacent network functions. However, lab environments, cloud-native deployments with inadequate network policies, and misconfigured container orchestration platforms may expose PCF SBI to broader network zones. No user interaction, authentication, or session establishment required - single HTTP request achieves unauthorized access.

CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) accurately reflects the attack surface: network-reachable SBI interfaces with zero authentication hurdle. The high confidentiality rating corresponds to SUPI (Subscription Permanent Identifier) leakage, which maps to subscriber phone numbers in 5G networks. Low integrity impact reflects unauthorized policy manipulation capabilities. No EPSS score available, but publicly available exploit code exists (PoC in vendor advisory). Not listed in CISA KEV, suggesting targeted or lab-environment risk rather than mass exploitation. Real-world exposure depends on SBI network segmentation - operators following 3GPP security guidelines isolate SBI on management networks unreachable from external attackers, significantly reducing practical risk. However, misconfigurations exposing PCF SBI to untrusted zones (cloud deployments, research networks, insecure container orchestration) create critical exposure. The trivial exploit complexity (single HTTP GET without credentials) makes this automatable once network access exists. Priority is HIGH for operators with SBI exposure, MEDIUM for properly segmented deployments where defense-in-depth still mandates patching.

An attacker with network access to the PCF SBI interface (default TCP 8000) sends an HTTP GET request to http://[PCF_IP]:8000/npcf-smpolicycontrol/v1/sm-policies/{smPolicyId} without an Authorization header, bypassing OAuth validation. The server returns a 200 response containing session management policy data including the subscriber's SUPI (permanent subscriber identifier). The attacker repeats requests with enumerated policy IDs or POSTs to create/modify policies, enabling subscriber tracking across sessions, QoS manipulation, or reconnaissance for further 5G core attacks. The vendor-provided PoC demonstrates this against default free5GC lab deployments.