Remote Denial of Service Vulnerability in Open5GS MME by Open5GS

CVE-2023-37016

What is CVE-2023-37016?

The vulnerability affects Open5GS MME, where versions up to 2.6.4 are susceptible to a denial of service condition. This is caused by an assertion that can be triggered remotely through a malformed ASN.1 packet sent over the S1AP interface. Specifically, an attacker can exploit the flaw by sending a crafted 'UE Context Modification Response' message lacking the necessary 'MME_UE_S1AP_ID' field. This can lead to repeated crashes of the MME, disrupting service availability.

References