CVE-2023-37016
Published: 22 January 2025
Summary
CVE-2023-37016 is a high-severity Reachable Assertion (CWE-617) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-37016 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure triggered by a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Modification Response message lacking the required MME_UE_S1AP_ID field, causing the MME process to crash. This issue is classified under CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, and scope change.
Any unauthenticated remote attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly transmitting the malformed UE Context Modification Response, the attacker can crash the MME process multiple times, leading to a denial-of-service condition that disrupts core network functions for user equipment context management.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40936
Vulnerability details
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash…
more
the MME, resulting in denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed packet triggers reachable assertion crash (CWE-617) enabling application/system DoS via remote exploitation of the exposed S1AP service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the software flaw causing assertion failure in Open5GS MME from malformed S1AP packets by monitoring vulnerabilities and applying patches.
Protects against denial-of-service by limiting effects of repeated MME crashes triggered by malformed UE Context Modification Response packets.
Validates content of incoming S1AP ASN.1 packets to reject malformed messages missing required fields like MME_UE_S1AP_ID.