The free5GC core network software contains critical authentication and authorization flaws that could allow unauthenticated attackers to impact network availability.

This vulnerability involves missing authentication (CWE-306) and authorization (CWE-862) for critical functions, alongside a NULL pointer dereference (CWE-476). The vulnerability is remotely exploitable (AV:N) by an unauthenticated attacker, potentially leading to denial-of-service or improper network control.

Exploitation of these flaws poses a significant risk to 5G network core integrity. An attacker could potentially crash critical network services or bypass security controls, resulting in system downtime and potential unauthorized access to network management functions. The CVSS score of 8.2 reflects the high impact on availability and the lack of required authentication.

Immediate Action: Upgrade to free5GC version 4.2.2 or later and ensure the Go package github.com/free5gc/smf is updated to version 1.4.3.

Proactive Monitoring: Monitor network core logs for abnormal request patterns or service crashes that might indicate exploitation attempts.

Compensating Controls: Implement strict network ingress filtering and segmentation to restrict access to the 5G core control plane to authorized management subnets only.

Public Exploit Available: No

Due to the critical nature of core network infrastructure, administrators must apply these updates immediately. Given the remote exploitability, failure to patch leaves the 5G core exposed to significant operational and security risks.