The free5GC 5G core network implementation is susceptible to a missing authorization vulnerability that could allow unauthenticated attackers to interact with core network functions.

This is a missing authorization flaw (CWE-862) occurring within the Policy Control Function (PCF) of the free5GC core network. It is remotely exploitable without authentication, allowing an attacker to bypass intended access controls.

Unauthorized access to the 5G core network functions can lead to service disruption, policy manipulation, or unauthorized network traffic handling. With a CVSS score of 8.2, this vulnerability poses a significant risk to the availability and integrity of telecommunications infrastructure, potentially impacting a large number of downstream users.

Immediate Action: Update the free5GC deployment to version 4.2.2 or, specifically for the PCF component, to version 1.4.3.

Proactive Monitoring: Monitor network traffic for unauthorized API requests targeting the PCF or other core network functions and review system logs for irregular access attempts.

Compensating Controls: Implement network-level access control lists (ACLs) to restrict access to the 5G core signaling interfaces to trusted and verified entities only.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of core telecommunications infrastructure, immediate patching to the updated versions is mandatory. Organizations should conduct a thorough audit of their network exposure to ensure that core signaling components are not reachable from untrusted networks.