IMSI-catcher

IMSI-catcher このプログラムは、あなたの周りの携帯電話のIMSI番号、国、ブランド、通信事業者を表示します。 /!\ このプログラムはGSMネットワークの仕組みを理解するために作られました。悪用するためではありません！ What you need Gnu/Linuxを搭載したPC 1台。動作確認済み: debian 10 Ubuntu 20.04/LinuxMint 22.2+ Kali 2025+ SDR受信機 1台。動作確認済み: アンテナ付きUSB DVB-Tキー RTL2832U 15ドル未満 OsmocomBB phone HackRF BladeRF Setup...

rayhunter

Rayhunter Rayhunter は、IMSIキャッチャー（セルサイトシミュレーターまたはスティングレイとも呼ばれます）を検出するためのプロジェクトです。当初は Orbic RC400L と呼ばれる安価なモバイルホットスポットで動作するように設計されましたが、コミュニティの尽力により、他のいくつかのデバイスにも対応しています。 また、技術スキルのレベルに関係なく、できるだけ簡単にインストールおよび使用でき、誤検知を最小限に抑えるようにも設計されています。 → インストールガイドをチェックして、始めましょう。 →...

LTESniffer

LTESniffer - 一款开源的LTE下行/上行链路窃听器 LTESniffer 是一款开源的LTE下行/上行链路窃听器。 它首先解码物理下行控制信道（PDCCH），以获取所有活跃用户的物理下行控制信息（DCI）和无线网络临时标识符（RNTI）。利用解码后的DCI和RNTI，LTESniffer进一步解码物理下行共享信道（PDSCH）和物理上行共享信道（PUSCH），以检索上行和下行数据流量。...

CVE-2026-67596

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...

GO-2026-5770 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core

Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core...

CVE-2026-34762

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/imsi API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's polic...

CVE-2026-34762

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/imsi API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's polic...

CVE-2026-34762

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/imsi API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's polic...

Ella Core 输入验证错误漏洞

Ella Core is an open-source solution developed by Ella Networks for use in private networks as a 5G core network solution. Prior to version 1.8.0 of Ella Core, there was a vulnerability related to input validation errors. This vulnerability stemmed from the lack of validation in the PUT...

CVE-2022-33687

Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log...

CVE-2022-33697

Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log...

CVE-2022-33688

Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

PT-2026-1850

Name of the Vulnerable Software and Affected Versions OpenAirInterface CN5G AMF versions prior to v2.1.9 Description A buffer overflow condition exists in the processing of NAS messages. Remote attackers can potentially cause a denial-of-service and possibly execute code by sending an imsi string...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-63292

Freebox v5 HD firmware = 1.7.20, Freebox v5 Crystal firmware = 1.7.20, Freebox v6 Révolution r1–r3 firmware = 4.7.x, Freebox Mini 4K firmware = 4.7.x, and Freebox One firmware = 4.7.x were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM...

CVE-2025-63292

CVE-2025-63292 affects Freebox v5 HD (firmware 1.7.20), Freebox v5 Crystal (1.7.20), Freebox v6 Révolution r1–r3 (4.7.x), Freebox Mini 4K (4.7.x), and Freebox One (4.7.x). The root issue is that during the initial phase of EAP-SIM over the FreeWifi_secure network, the subscriber’s full NAI (embed...

CVE-2025-63292

Freebox v5 HD firmware = 1.7.20, Freebox v5 Crystal firmware = 1.7.20, Freebox v6 Révolution r1–r3 firmware = 4.7.x, Freebox Mini 4K firmware = 4.7.x, and Freebox One firmware = 4.7.x were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM...