Skip to content
Noroxi

Open5GS records

154 published records for vendor open5gs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
4.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

154 records
  • CVE-2021-28122
    40Plan

    A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1.

    CriticalCVSS 9.8No exploitEPSS 3%

    open5gs · open5gsMar 10, 2021

  • CVE-2024-40130
    39Monitor

    open5gs v2.6.4 is vulnerable to Buffer Overflow.

    CriticalCVSS 9.8No exploitEPSS 0%

    open5gs · open5gsJul 16, 2024

  • CVE-2024-40129
    39Monitor

    Open5GS v2.6.4 is vulnerable to Buffer Overflow.

    CriticalCVSS 9.8No exploitEPSS 0%

    open5gs · open5gsJul 16, 2024

  • CVE-2021-25863
    35Monitor

    Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.

    HighCVSS 8.8No exploitEPSS 1%

    open5gs · open5gsJan 26, 2021

  • CVE-2023-37021
    34Monitor

    Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37019
    34Monitor

    Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37020
    34Monitor

    Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37015
    34Monitor

    Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2024-34235
    34Monitor

    Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37017
    34Monitor

    Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37023
    34Monitor

    Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37018
    34Monitor

    Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2023-37016
    34Monitor

    Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface.

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2024-24429
    34Monitor

    A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a

    HighCVSS 8.6No exploitEPSS 0%

    open5gs · open5gsJan 22, 2025

  • CVE-2025-41067
    34Monitor

    Reachable Assertion vulnerability in Open5GS

    HighCVSS 8.7Proof of conceptEPSS 0%

    open5gs · open5gsOct 27, 2025

  • CVE-2025-41068
    34Monitor

    Reachable Assertion vulnerability in Open5GS

    HighCVSS 8.7No exploitEPSS 0%

    open5gs · open5gsOct 27, 2025

  • CVE-2021-45462
    31Monitor

    In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.

    HighCVSS 7.5No exploitEPSS 4%

    open5gs · open5gsDec 23, 2021

  • CVE-2025-44952
    31Monitor

    A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a

    HighCVSS 7.8No exploitEPSS 0%

    open5gs · open5gsJun 18, 2025

  • CVE-2021-44109
    30Monitor

    A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request.

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsApr 4, 2022

  • CVE-2021-44108
    30Monitor

    A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsApr 4, 2022

  • CVE-2021-41794
    30Monitor

    ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow.

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsOct 7, 2021

  • CVE-2022-39063
    30Monitor

    When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Respons

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsSep 16, 2022

  • CVE-2024-51179
    30Monitor

    An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as t

    HighCVSS 7.5Proof of conceptEPSS 1%

    open5gs · open5gsNov 12, 2024

  • CVE-2021-44081
    30Monitor

    A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4.

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsMar 29, 2022

  • CVE-2022-40890
    30Monitor

    A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.

    HighCVSS 7.5No exploitEPSS 1%

    open5gs · open5gsSep 29, 2022