CVE-2023-36998

Katalog CVE

CVSS 8.9 · High EPSS 0,36%

Kerentanan Stack-based Buffer Overflow. Skor CVSS 3.1 8.9 (High) menurut CISA ADP.

Deskripsi (NVD)

The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.

Rincian

Terbit di NVD

22 Januari 2025

Terakhir diubah

5 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.9 (High), sumber CISA ADP
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://cellularsecurity.org/ransacked