The open-source free5gc 5G core network implementation is vulnerable to a critical input validation flaw that permits unauthenticated attackers to manipulate network-function discovery and intercept signaling traffic.

The NRF RegisterNFInstance handler fails to enforce critical validation constraints on incoming NF Profiles, such as UUID formats and mandatory fields. This allows an unauthenticated attacker with Service-Based Architecture (SBI) access to register malicious endpoints, effectively poisoning the network discovery process.

Successful exploitation of this vulnerability poses a severe risk to the integrity and confidentiality of 5G core network operations. By redirecting control-plane signaling, an attacker can expose sensitive credentials, compromise the integrity of service discovery, or cause widespread denial of service across any network functions that rely on the NRF. Given the CVSS score of 9.3, this represents a critical threat to carrier-grade infrastructure that requires immediate attention.

Immediate Action: Upgrade the free5gc core network implementation to version 4.2.3 or later to apply the necessary input validation checks.

Proactive Monitoring: Monitor Service-Based Architecture (SBI) traffic for anomalous registration requests or unexpected endpoint advertisements within the NRF logs.

Compensating Controls: Implement strict network segmentation and utilize mutual TLS (mTLS) for all Service-Based Interface communications to restrict unauthorized access to the NRF endpoint until the patch is applied.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk to 5G core deployments, potentially allowing attackers to hijack core signaling traffic. Organizations utilizing free5gc must prioritize the update to version 4.2.3 immediately. Failure to patch leaves the core network infrastructure vulnerable to sophisticated interception and service disruption attacks.