EUVD-2026-82610
GHSA-9qfw-v8ph-47fv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated resource-exhaustion with no user interaction (AV:N/AC:L/PR:N/UI:N); only partial availability impact (A:L) and no confidentiality/integrity effect, matching CWE-770 DoS.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.
AnalysisAI
Uncontrolled resource allocation in the VES Collector component of O-RAN-SC SMO OAM (2025-06-10) lets remote, unauthenticated attackers exhaust resources and degrade availability, with no confidentiality or integrity impact (VC:N/VI:N/VA:L). The CVSS 4.0 base of 6.9 reflects network reachability with no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) and a proof-of-concept exploit is publicly available via a GitHub gist, though there is no confirmed actively exploited (CISA KEV) status. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to a deployed O-RAN-SC SMO OAM VES Collector accepting VES (VNF Event Stream) events; per CVSS AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base of 6.9 is driven entirely by an availability impact (VC:N/VI:N/VA:L) reachable remotely and unauthenticated (AV:N/AC:L/PR:N/UI:N), consistent with a CWE-770 uncontrolled resource-allocation flaw in the VES Collector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: the issue was reported upstream via LF-O-RAN-SC Jira SMO-204 and the project had not responded, so no fixed version number can be cited and none should be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today