285 matches found
CVE-2025-5501 Open5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertion
A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngaphandlepathswitchrequesttransfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to reachable assertion...
PT-2025-23617 · Open5Gs · Open5Gs
Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to...
PT-2025-23656 · Open5Gs · Open5Gs
Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function gmm state authentication/emm state authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack...
CVE-2024-34476
Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogsnasencrypt in lib/nas/common/security.c for pkbuf-len...
CVE-2024-33382
An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration...
CVE-2024-34475
Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmmstateauthentication in amf/gmm-sm.c for != OGSERROR...
CVE-2024-40130
open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c...
CVE-2024-57519
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogsdbiauthinfo function in lib/dbi/subscription.c file...
CVE-2024-24429
A reachable assertion in the nasepssendemmtoesm function of Open5GS = 2.6.4 allows attackers to cause a Denial of Service DoS via a crafted NGAP packet...
CVE-2024-24427
A reachable assertion in the amfuesetsuci function of Open5GS = 2.6.4 allows attackers to cause a Denial of Service DoS via a crafted NAS packet...
CVE-2023-4884
An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication...
CVE-2023-37006
Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a Handover Request Ack message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...
CVE-2023-37023
Open5GS MME versions = 2.6.4 contain a reachable assertion in the Uplink NAS Transport packet handler. A packet missing its MMEUES1APID field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service...
CVE-2023-37012
Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial UE Message message missing a required PLMN Identity field to repeatedly crash the MME, resulting in denial of service...
CVE-2022-3354
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and ma...
CVE-2022-43223
open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted UE attachment...
CVE-2022-3299
A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality in the library lib/sbi/client.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. The name of th...
CVE-2022-39063
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the fteidlen from incoming message, and then uses it to copy data from incoming message to struct fteid without...
CVE-2021-41794
ogsfqdnparse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used ...