CVE-2026-42459

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Improper Input Validation pada free5gc. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can inject control characters into the SUPI parameter, causing UDM to forward a malformed request to UDR and return a 500 Internal Server Error response that exposes internal infrastructure details. This vulnerability is fixed in 4.2.2.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr exploit · mitigasi · advisory vendor