CVE-2023-37020
Published: 22 January 2025
Summary
CVE-2023-37020 is a high-severity Reachable Assertion (CWE-617) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-37020 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure that can be triggered remotely via a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Release Complete message lacking the required MME_UE_S1AP_ID field, causing the MME to crash. This issue is classified under CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, and scope change with high availability impact.
Any unauthenticated remote attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly transmitting the malformed UE Context Release Complete message, the attacker can crash the MME process, leading to a denial-of-service condition that disrupts core network functions for user equipment context management.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40940
Vulnerability details
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Complete` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash…
more
the MME, resulting in denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in exposed S1AP interface of MME allows remote unauthenticated exploitation of reachable assertion (CWE-617) to crash the process, directly enabling T1190 for initial access via public-facing app and T1499.004 for DoS via application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing the assertion failure in Open5GS MME by applying patches to prevent crashes from malformed S1AP packets.
SI-10 mandates information input validation, which would reject malformed UE Context Release Complete messages missing the required MME_UE_S1AP_ID field before triggering the assertion.
SC-5 provides denial-of-service protection mechanisms, such as rate limiting or traffic filtering on the S1AP interface, to mitigate repeated malformed packets causing MME crashes.