Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Open5GS NRF サービス拒否 CVE-2025-41067 & CVE-2025-41068 このリポジトリには、NewPlaneのOpen5GSで発見された重大度の高い2つの脆弱性に対するProof-of-Concept PoC エクスプロイトスクリプトが含まれています。これらの脆弱性は、攻撃者によってトリガーされることで、NRF Network Repository Function コンポーネントにサービス拒否 DoS を引き起こす可能性があります。 脆弱性の詳細 CVEs: CVE-2025-41067, CVE-2025-41068 影響を受けるソフトウェア:...

CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2023-46870

CVE-2023-46870 Nordic Semiconductor nRF Sniffer for Bluetooth LE versionen 3.0.0, 3.1.0, 4.0.0, 4.1.0 und 4.1.1 haben falsche Dateiberechtigungen gesetzt, was es Angreifern ermöglicht, eine Privilegienausweitung und Codeausführung durchzuführen, indem sie Bash- und Python-Skripte modifizieren...

GHSA-X8MJ-6P3Q-G5PP free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-67115

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30067

A vulnerability in the complexQueryFilterSubprocess function within the NRF Discovery service of free5gc v4.0.1 allows an unauthenticated remote attacker to trigger a Denial of Service (DoS) via a crafted input. The CVSS 3.1 score is 7.5 (High) , with the attack vector being network-based, low co...

CVE-2026-30067

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

GO-2026-5570 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf...

PT-2026-83235

Name of the Vulnerable Software and Affected Versions free5GC versions 4.2.2 and earlier Description The RegisterNFInstance handler at the endpoint PUT /nnrf-nfm/v1/nf-instances/nfInstanceID fails to validate NF profiles against 3GPP TS 29.510 constraints. This allows an attacker with Service-Bas...

CVE-2026-44325

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/apiaccesstoken.go reflects over models.NrfAccessTokenAccessTokenReq,...

CVE-2026-44325 free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/apiaccesstoken.go reflects over models.NrfAccessTokenAccessTokenReq,...

CVE-2026-44325

CVE-2026-44325 affects free5GC NRF (v4.2.1) where POST /oauth2/token parses form data with a reflective type-confusion in api_accesstoken.go. The handler reflects over NrfAccessTokenAccessTokenReq, incorrectly treating most fields as a *models.PlmnId and assigns it to various destination fields, ...

free5GC 安全漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained a security vulnerability. This vulnerability stemmed from a parser type confusion in the NRF’s OAuth2 token endpoint, which could potentially cause a panic due to a single...

CVE-2026-8729

A vulnerability was detected in Open5GS up to 2.7.7. This affects an unknown function in the library /lib/sbi/message.c of the component NRF. Performing a manipulation of the argument service-names/snssais results in denial of service. The attack is possible to be carried out remotely. The exploi...

CVE-2026-8728

A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogssbidiscoveryoptionparseplmnlist in the library /lib/sbi/conv.c of the component NRF. Such manipulation of the argument target-plmn-list leads to denial of service. The attack can be executed...