CVE-2025-0650 Ovn: egress acls may be bypassed via specially crafted udp packet

A flaw was found in the Open Virtual Network OVN. Specially crafted UDP packets may bypass egress access control lists ACLs in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized...

CVE-2025-0650

OVN/Open vSwitch vulnerability CVE-2025-0650 enables bypass of egress ACLs via specially crafted UDP packets on a logical switch with DNS records and existing egress ACLs, potentially allowing unauthorized access to VMs/containers. Public advisories (SUSE/SUSE-SU-2026:0280-1 and 0290-1) recommend...

Custom Backdoor Exploiting Magic Packet Vulnerability in Juniper Routers

Enterprise-grade Juniper Networks routers have become the target of a custom backdoor as part of a campaign dubbed J-magic. According to the Black Lotus Labs team at Lumen Technologies, the activity is so named for the fact that the backdoor continuously monitors for a "magic packet" sent by the...

Open Virtual Network 访问控制错误漏洞

Open Virtual Network OVN is an open virtual network open sourced by Open Virtual Network. A security vulnerability exists in Open Virtual Network OVN that stems from a specially constructed UDP packet that can bypass an egress ACL, resulting in unauthorized access to virtual machines and containe...

CVE-2024-24429

A reachable assertion in the nasepssendemmtoesm function of Open5GS = 2.6.4 allows attackers to cause a Denial of Service DoS via a crafted NGAP packet...

CVE-2024-34235

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial UE Message missing a required NASPDU field to repeatedly crash the MME, resulting in denial of service...

CVE-2024-24430

A reachable assertion in the mmeuefindbyimsi function of Open5GS = 2.6.4 allows attackers to cause a Denial of Service DoS via a crafted NAS packet...

CVE-2023-37018

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Capability Info Indication message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37019

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an S1Setup Request message missing a required Supported TAs field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37020

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Context Release Complete message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37022

Open5GS MME versions = 2.6.4 contain a reachable assertion in the UE Context Release Request packet handler. A packet containing an invalid MMEUES1APID field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service...

CVE-2023-37023

Open5GS MME versions = 2.6.4 contain a reachable assertion in the Uplink NAS Transport packet handler. A packet missing its MMEUES1APID field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service...

CVE-2023-37017

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an S1Setup Request message missing a required Global eNB ID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37010

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an eNB Status Transfer message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37012

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial UE Message message missing a required PLMN Identity field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37005

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an Initial Context Setup Failure message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37011

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a Handover Required message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37007

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a Handover Cancel message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-37002

Open5GS MME versions = 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an E-RAB Modification Indication message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

PT-2025-1396 · Open5Gs · Open5Gs Mme

Name of the Vulnerable Software and Affected Versions: Open5GS MME versions prior to 2.6.4 Description: The issue allows an attacker to send a malformed ASN.1 packet over the S1AP interface, triggering an assertion that can cause a denial of service. Specifically, an attacker may send an "Initial...