Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-44329

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Ver en NVD

Análisis

The free5GC open-source 5G core network implementation has a critical authentication bypass in its Session Management Function (SMF). Remote attackers can interact with UPI management endpoints without any authorization, allowing them to read, modify, or delete UP-nodes and links within the 5G core.

Severidad

Puntaje: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: LOW
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-306CWE-862

EPSS

Probabilidad de explotación (próx. 30 días): 0.0005 (0.0%)
Percentil: 15.0%
EPSS: 2026-05-28

Afecta

free5gc:free5gc

Descripción técnica

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Publicada: 27/5/2026, 17:16:38
Última modificación: 28/5/2026, 16:23:13

Referencias

InicioEventosBlogRecursosEquipo