Cyber Resilience

CVE-2024-24429

HighPublic PoC

Published: 22 January 2025

Published
22 January 2025
Modified
22 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0018 39.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-24429 is a high-severity Reachable Assertion (CWE-617) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-11 (Error Handling).

Deeper analysis

CVE-2024-24429 is a reachable assertion vulnerability in the nas_eps_send_emm_to_esm function within Open5GS versions up to and including 2.6.4. This flaw allows attackers to trigger a Denial of Service (DoS) condition through a specially crafted NGAP packet. The vulnerability is rated with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and is associated with CWE-617 (Reachable Assertion). It was published on 2025-01-22.

Unauthenticated attackers with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. By sending a malicious NGAP packet to a vulnerable Open5GS instance, an attacker can cause the assertion to fail, leading to a crash and high-impact availability disruption. The changed scope (S:C) indicates potential effects beyond the vulnerable component.

Mitigation details and further advisories are available at https://cellularsecurity.org/ransacked.

EU & UK References

Vulnerability details

A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.

CWE(s)
CWE-617

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Crafted NGAP packet exploits public-facing Open5GS service (T1190) to trigger assertion failure and crash, directly enabling application exploitation for endpoint DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-24427Same product: Open5Gs Open5Gs
CVE-2024-24428Same product: Open5Gs Open5Gs
CVE-2025-15530Same product: Open5Gs Open5Gs
CVE-2026-2523Same product: Open5Gs Open5Gs
CVE-2024-24430Same product: Open5Gs Open5Gs
CVE-2023-37023Same product: Open5Gs Open5Gs
CVE-2024-34235Same product: Open5Gs Open5Gs
CVE-2023-37019Same product: Open5Gs Open5Gs
CVE-2023-37013Same product: Open5Gs Open5Gs
CVE-2023-37020Same product: Open5Gs Open5Gs

Affected Assets

open5gs
open5gs
≤ 2.6.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by identifying, testing, and installing patches for the reachable assertion vulnerability in Open5GS.

SC-5 Denial-of-service Protection good match
preventdetect

Protects against DoS attacks from crafted NGAP packets by implementing denial-of-service defenses such as rate limiting and traffic filtering.

SI-11 Error Handling good match
prevent

Ensures error handling in nas_eps_send_emm_to_esm does not result in crashes from assertion failures on malformed inputs.

References