CVE-2023-37014

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37014: Uncontrolled Resource Consumption

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2024-34235

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial UE Message missing a required NASPDU field to repeatedly crash the MME, resulting in denial of service...

PT-2025-1412 · Open5Gs · Open5Gs Mme

Name of the Vulnerable Software and Affected Versions: Open5GS MME versions prior to 2.6.4 Description: The issue allows an attacker to send a "UE Context Release Complete" message without the required MME UE S1AP ID field, which can cause the MME to crash repeatedly, resulting in denial of...

CVE-2023-37014

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

Open5GS 安全漏洞

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. A security vulnerability exists in the Open5GS amfuesetsuci function, which can be exploited by an attacker to trigger a denial of service DoS via a crafted NGAP packet...

CVE-2023-37030: NULL Pointer Dereference

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected eNBUES1APID field...

CVE-2023-37033: NULL Pointer Dereference

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected EUTRANCGI field...

CVE-2023-37034: NULL Pointer Dereference

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected TAI field...

PT-2025-1426 · Magma · Magma

Name of the Vulnerable Software and Affected Versions: Magma versions 1.8.0 and earlier Description: A null pointer dereference issue in the Mobile Management Entity MME allows network-adjacent attackers to crash the MME via an S1AP "Initial UE Message" packet missing an expected TAI field. This...

PT-2025-1431 · Magma · Magma

Name of the Vulnerable Software and Affected Versions: Magma versions 1.8.0 and earlier Description: A Null pointer dereference issue in the Mobile Management Entity MME allows network-adjacent attackers to crash the MME via an S1AP "Initial UE Message" packet missing an expected RRC Establishmen...

CVE-2024-24455

CVE-2024-24455 affects Hewlett Packard Enterprise Athonet vEPC MME (version 11.4.0). The issue is an invalid memory access when handling a UE Context Release message that contains an invalid UE identifier, which can allow an attacker to cause a Denial of Service (DoS) to the cellular network by r...

CVE-2024-24455

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

PT-2024-20398 · Unknown · Openairinterface Cn5G Amf

Name of the Vulnerable Software and Affected Versions: OpenAirInterface CN5G AMF versions up to 2.0.0 Description: The issue is caused by an uninitialized pointer dereference in the NasPdu::NasPdu component, allowing attackers to cause a Denial of Service DoS via a crafted InitialUEMessage messag...

CVE-2024-24455: Out-of-bounds Read

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-23385

Transient DOS as modem reset occurs when an unexpected MAC RAR with invalid PDU length is seen at UE...

CVE-2024-23385 Reachable Assertion in Modem

Transient DOS as modem reset occurs when an unexpected MAC RAR with invalid PDU length is seen at UE...

CVE-2024-23385

CVE-2024-23385 affects Qualcomm closed‑source components. The issue is a Transient DoS where a modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is observed at the user equipment (UE). The connected sources confirm the affected vendor and the high availability impact, but do...

PUB-A-335031446

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-335031447

In the RRC code of the modem firmware, there is a possible information disclosure due to a logic error in the code. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...