Smo Oam
Monthly
Uncontrolled resource allocation in the VES Collector component of O-RAN-SC SMO OAM (2025-06-10) lets remote, unauthenticated attackers exhaust resources and degrade availability, with no confidentiality or integrity impact (VC:N/VI:N/VA:L). The CVSS 4.0 base of 6.9 reflects network reachability with no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) and a proof-of-concept exploit is publicly available via a GitHub gist, though there is no confirmed actively exploited (CISA KEV) status. The upstream project was notified through a bug report (LF-O-RAN-SC Jira SMO-204) but has not responded, so no vendor-released patch is identified at time of analysis; practical exposure is limited to deployments where the VES Collector is reachable on an internal telecom OAM/management plane.
Uncontrolled resource allocation in the VES Collector component of O-RAN-SC SMO OAM (2025-06-10) lets remote, unauthenticated attackers exhaust resources and degrade availability, with no confidentiality or integrity impact (VC:N/VI:N/VA:L). The CVSS 4.0 base of 6.9 reflects network reachability with no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) and a proof-of-concept exploit is publicly available via a GitHub gist, though there is no confirmed actively exploited (CISA KEV) status. The upstream project was notified through a bug report (LF-O-RAN-SC Jira SMO-204) but has not responded, so no vendor-released patch is identified at time of analysis; practical exposure is limited to deployments where the VES Collector is reachable on an internal telecom OAM/management plane.