Denial of Service Vulnerability in Open5GS MME by Open5GS

CVE-2023-37021

What is CVE-2023-37021?

Open5GS MME versions 2.6.4 and earlier exhibit a vulnerability that can be exploited through malformed ASN.1 packets sent over the S1AP interface. By manipulating the communication protocol with a UE Context Modification Failure message that omits the MME_UE_S1AP_ID field, an attacker can trigger repeated crashes of the MME. This results in service disruption, potentially affecting network availability and performance.

References