1. Home
  2. CVE Database
  3. CVE-2023-37008
MEDIUM · 5.3

CVE-2023-37008

Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid pars...

Vulnerability Description

Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid parsing and freeing of memory. An attacker may use this to crash an MME or potentially execute code in certain circumstances.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
Open5GsOpen5Gs<= 2.6.4

Related Weaknesses (CWE)

CWE-617

References

FAQ

What is CVE-2023-37008?

CVE-2023-37008 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid pars...

How severe is CVE-2023-37008?

CVE-2023-37008 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-37008?

Check the references section above for vendor advisories and patch information. Affected products include: Open5Gs Open5Gs.