Improper Error Handling in free5GC UDR Affects 5G Mobile Core Networks

CVE-2025-69208

What is CVE-2025-69208?

The User Data Repository (UDR) in free5GC, an open-source project for 5G mobile core networks, is affected by an improper error handling vulnerability that results in information exposure. In versions prior to 1.4.1, the Nnef_PfdManagement service can inadvertently leak internal parsing errors that can be exploited by attackers. This leakage aids in fingerprinting server software and understanding logic flows. The risk arises from the NEF component's behavior, which reliably returns detailed error messages to remote clients. Version 1.4.1 contains fixes for this vulnerability, and it is advisable to apply the available patch as there are no direct workarounds at the application level.

References