CVE-2023-37021
Published: 22 January 2025
Summary
CVE-2023-37021 is a high-severity Reachable Assertion (CWE-617) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 46.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates malformed ASN.1 S1AP packets, such as UE Context Modification Failure messages missing the required MME_UE_S1AP_ID field, to prevent triggering the assertion failure and MME crash.
Remediates the specific reachable assertion flaw (CWE-617) in Open5GS MME <=2.6.4 by applying patches or upgrades as advised in the vulnerability advisory.
Protects against remote unauthenticated denial-of-service attacks by implementing safeguards to mitigate repeated crashes from malformed S1AP packets over the network interface.
NVD Description
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Failure` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash…
more
the MME, resulting in denial of service.
Deeper analysisAI
CVE-2023-37021 affects Open5GS MME versions up to and including 2.6.4, where an assertion failure can be remotely triggered through a malformed ASN.1 packet over the S1AP interface. The issue arises when an attacker sends a UE Context Modification Failure message lacking the required MME_UE_S1AP_ID field, causing the MME to crash. This vulnerability, associated with CWE-617 (Reachable Assertion), was published on 2025-01-22 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, lack of privileges or user interaction, and scope change with high availability impact.
A remote, unauthenticated attacker can exploit this vulnerability by transmitting the malformed S1AP message to the targeted MME, leading to repeated crashes and denial of service. The attack requires no prior authentication or special access, as it leverages the S1AP interface typically exposed in 4G/5G core network deployments. Successful exploitation disrupts MME functionality, potentially halting user equipment context management and signaling for affected cells or networks.
Mitigation details are provided in the advisory at https://cellularsecurity.org/ransacked. Security practitioners should consult this reference for patch information, workarounds, or upgrade guidance for Open5GS MME.
Details
- CWE(s)