An information disclosure vulnerability in the Free5GC Unified Data Repository allows unauthenticated attackers to exfiltrate sensitive 5G subscriber identifiers, posing a significant risk to network privacy.

The UDR service fails to terminate execution after encountering an error in the handler for subscriber data queries, causing the application to return sensitive subscriber information (SUPI/IMSI) in the HTTP response body. This flaw is exploitable by an unauthenticated attacker with network access to the 5G Service Based Interface.

The exposure of SUPI/IMSI values directly undermines the core 5G privacy guarantees, potentially facilitating subscriber tracking and targeted surveillance. Given the CVSS score of 7.5, this high-severity vulnerability represents a critical failure in data protection for mobile core infrastructure, which could lead to severe regulatory non-compliance and loss of user trust.

Immediate Action: As no official patch is currently listed, administrators should restrict network access to the 5G Service Based Interface to trusted entities only and monitor the UDR service for unauthorized query patterns.

Proactive Monitoring: Review access logs for anomalous HTTP GET requests targeting the /nudr-dr/v2/application-data/influenceData/subs-to-notify endpoint, specifically monitoring for requests that trigger 400 error codes.

Compensating Controls: Deploy a Web Application Firewall or an API gateway to inspect and filter requests to the UDR service, specifically blocking requests that lack required query parameters or contain malformed SNSSAI values.

Public Exploit Available: Unknown.

Given the high impact on subscriber privacy and the existence of a proof-of-concept, organizations running Free5GC must treat this as a priority. While a formal patch is pending, strict network segmentation and API-level access controls are required to prevent unauthorized retrieval of sensitive subscriber data. Monitor official project repositories closely for the release of a fixed version.