CVE-2023-37014
Published: 22 January 2025
Summary
CVE-2023-37014 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-37014 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure that can be remotely triggered by a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Release Request message lacking the required MME_UE_S1AP_ID field, causing the MME process to crash.
Any remote unauthenticated attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly sending the malformed packet, the attacker can cause repeated crashes of the MME, resulting in a denial-of-service condition that disrupts core network services for user equipment context management. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects its high availability impact with low complexity and no privileges required.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40934
Vulnerability details
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash…
more
the MME, resulting in denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed packet over S1AP triggers remote assertion failure crash in MME, directly enabling application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the syntax and required fields of incoming S1AP packets, such as MME_UE_S1AP_ID in UE Context Release Request, to prevent assertion failures from malformed ASN.1 structures.
Ensures the MME handles missing or invalid fields in S1AP messages without crashing, maintaining availability despite malformed inputs.
Implements protections like rate limiting on the S1AP interface to mitigate denial-of-service from repeated malformed packets causing MME crashes.