CVE-2026-44321

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Missing Authentication for Critical Function pada free5gc. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into UpNodesFromConfiguration(), which calls logger.InitLog.Fatalf(...) on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (docker ps shows Exited (1)), not just the goroutine. This vulnerability is fixed in 4.2.2.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-617: Reachable Assertion
CWE-862: Missing Authorization

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/free5gc/free5gc/security/advisories/GHSA-44qj-cghf-9p97 exploit · advisory vendor
• https://github.com/free5gc/smf/commit/e0974e07ddab44a67d36a563cca383b2449e33e5 patch
• https://github.com/free5gc/smf/pull/203 issue tracking · patch
• https://github.com/free5gc/free5gc/issues/906 exploit · issue tracking