CVE-2023-37015
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Path Switch Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
Security Summary
CVE-2023-37015 is a vulnerability in Open5GS MME versions up to and including 2.6.4, where an assertion failure can be remotely triggered by a malformed ASN.1 packet over the S1AP interface. The issue stems from sending a Path Switch Request message that lacks the required MME_UE_S1AP_ID field, causing the MME to crash. It is classified under CWE-617 with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), highlighting its critical availability impact.
An unauthenticated attacker with network access to the S1AP interface can exploit this vulnerability by transmitting the malformed Path Switch Request, repeatedly crashing the MME and causing a denial of service. No privileges, user interaction, or special conditions are required beyond network reachability, and the changed scope amplifies the potential disruption to the affected 5G core network component.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked, which was referenced alongside the CVE disclosure on 2025-01-22.
Details
- CWE(s)