DRA_writeup

Oracle DSR のセキュリティ脆弱性 KPN CISO REDteam KPNはオランダに拠点を置く通信事業者です。CISO REDteamは2013年に発足したKPNの倫理的ハッキングチームです。このチームは、KPNのアプリケーションおよびサービスに対するセキュリティテストを実施し、顧客のデータが不正アクセス、改ざん、データ損失から安全であることを保証しています。 Diameter Routing Agent の背景 KPNはオランダ最大のモバイルネットワークを運営しています。KPNが運用する4Gネットワークの構成要素の1つが、Oracle Diameter Signalling...

CVE-2026-22012-Diameter-Protocol-Credit-Control-Bypass-in-5G

CVE-2026-22012 – 5G 中的 Diameter 协议 Credit‑Control 绕过 程序代码（Python Diameter 模拟） root@kitploit: diametercreditcontrolsim.py - Simulated OCS with missing final-unit indication class OCS: def processCCRself, request: Vulnerability: always returns SUCCESS with same quota, never sends final-unit return...

CVE-2025-15684

A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diamlogfunc of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading...

CVE-2025-15684 Open5GS CER init.c diam_log_func assertion

A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diamlogfunc of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading...

CVE-2025-15684

Open5GS (affected up to 2.7.6) is vulnerable via diam_log_func in lib/diameter/common/init.c (CER Handler). The issue allows a remote attacker to trigger a reachable assertion. Public exploit appears available. Remediation: upgrade to Open5GS 2.7.7, which includes patch c1a803516a3c0485696cb9bcca...

Linux Distros Unpatched Vulnerability : CVE-2026-54345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fix...

GHSA-6R28-9PPF-4HJ5 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...

Maybe the Phone System Surveillance Vulnerabilities Will Be Fixed

It seems that the FCC might be fixing the vulnerabilities in SS7 and the Diameter protocol: On March 27 the commission asked telecommunications providers to weigh in and detail what they are doing to prevent SS7 and Diameter vulnerabilities from being misused to track consumers locations. The FCC...

CVE-2018-5522

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash...

Wireshark DIAMETER parser denial of service vulnerability

Wireshark is the most popular network protocol parser. In Wireshark versions 2.0.x before 2.0.1 and 1.12.x before 1.12.9, the function dissectdiameterbaseframedipv6prefix in epan/dissectors/packet-diameter.c in the DIAMETER parser does not properly validate the IPv6 prefix length. prefix does not...