Openairinterface
Monthly
A stack-based buffer overflow in the OpenAirInterface CN5G UDM (v2.2.1) lets an unauthenticated network attacker who can reach the Service-Based Interface and supply a valid SUPI crash the UDM process by sending an oversized hex string in resynchronizationInfo.rand or auts to the Nudm_UEAU Generate Authentication Data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) rates this 7.5, but real-world exposure is constrained: the SBI is normally an internal, segmented network between 5G core functions rather than an internet-facing surface, and the demonstrated outcome is stack-canary corruption leading to process termination, not code execution. No CISA KEV entry exists; a public gist reference is linked in the advisory data, but it is not verified as working exploit code, so treat this as a credible DoS bug with a potentially high blast radius for core-network availability rather than a confirmed actively exploited flaw.
Denial of service in OpenAirInterface CN5G AMF v2.2.1 allows a remote, unauthenticated attacker to crash the AMF process by sending a crafted NAS Registration Request containing a malformed IMEISV in the 5GS Mobile Identity IE. The root cause is an integer truncation (CWE-197) in the NAS decoder: Type6NasIe::Validate() truncates a 32-bit length to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(). CVSS 3.1 is 7.5 with availability-only impact; delivery requires NAS/N1 signaling access, normally through a gNB or the N2 reference point, so exposure is not equivalent to an internet-facing service. No CISA KEV listing or confirmed active exploitation is reported; a public gist reference exists but is not verified as working exploit code.
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack. [CVSS 7.5 HIGH]
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF. [CVSS 7.5 HIGH]
A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow in the OpenAirInterface CN5G UDM (v2.2.1) lets an unauthenticated network attacker who can reach the Service-Based Interface and supply a valid SUPI crash the UDM process by sending an oversized hex string in resynchronizationInfo.rand or auts to the Nudm_UEAU Generate Authentication Data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) rates this 7.5, but real-world exposure is constrained: the SBI is normally an internal, segmented network between 5G core functions rather than an internet-facing surface, and the demonstrated outcome is stack-canary corruption leading to process termination, not code execution. No CISA KEV entry exists; a public gist reference is linked in the advisory data, but it is not verified as working exploit code, so treat this as a credible DoS bug with a potentially high blast radius for core-network availability rather than a confirmed actively exploited flaw.
Denial of service in OpenAirInterface CN5G AMF v2.2.1 allows a remote, unauthenticated attacker to crash the AMF process by sending a crafted NAS Registration Request containing a malformed IMEISV in the 5GS Mobile Identity IE. The root cause is an integer truncation (CWE-197) in the NAS decoder: Type6NasIe::Validate() truncates a 32-bit length to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(). CVSS 3.1 is 7.5 with availability-only impact; delivery requires NAS/N1 signaling access, normally through a gNB or the N2 reference point, so exposure is not equivalent to an internet-facing service. No CISA KEV listing or confirmed active exploitation is reported; a public gist reference exists but is not verified as working exploit code.
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack. [CVSS 7.5 HIGH]
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF. [CVSS 7.5 HIGH]
A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.