CVE-2023-37018
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Capability Info Indication` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
Security Summary
CVE-2023-37018 is a vulnerability in Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. It involves a reachable assertion (CWE-617) that can be remotely triggered by a malformed ASN.1 packet over the S1AP interface. An attacker sends a UE Capability Info Indication message missing the required MME_UE_S1AP_ID field, causing the assertion to fail.
The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to network accessibility, low attack complexity, no privileges or user interaction required, changed scope, and high availability impact. Any unauthenticated remote attacker with access to the S1AP interface can exploit it by transmitting the malformed message, crashing the MME process. Repeated exploitation results in sustained denial of service against the MME.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)