CVE-2023-46870

CVE-2023-46870 Nordic Semiconductor nRF Sniffer for Bluetooth LE 버전 3.0.0, 3.1.0, 4.0.0, 4.1.0 및 4.1.1에는 잘못된 파일 권한이 설정되어 있어, 공격자가 bash 및 python 스크립트를 수정하여 권한 상승 및 코드 실행을 수행할 수 있습니다. Keywords: Local Privilege Escalation LPE, Code Execution Affected Platform: Linux, MacOS Affected Files:...

Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Open5GS NRF サービス拒否 CVE-2025-41067 & CVE-2025-41068 このリポジトリには、NewPlaneのOpen5GSで発見された重大度の高い2つの脆弱性に対するProof-of-Concept PoC エクスプロイトスクリプトが含まれています。これらの脆弱性は、攻撃者によってトリガーされることで、NRF Network Repository Function コンポーネントにサービス拒否 DoS を引き起こす可能性があります。 脆弱性の詳細 CVEs: CVE-2025-41067, CVE-2025-41068 影響を受けるソフトウェア:...

SUSE CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

GO-2026-6316 free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints in github.com/free5gc/free5gc...

CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

GHSA-X8MJ-6P3Q-G5PP free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

EUVD-2026-67835

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...

CVE-2026-55068: Improper Input Validation

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-67115

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-82531

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30067: Allocation of Resources Without Limits or Throttling

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

GO-2026-6161 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure in github.com/free5gc/ausf

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure in github.com/free5gc/ausf...