Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in the free5GC software, an open-source implementation of a 5G core network. The issue allows unauthenticated network attackers to potentially access and manipulate critical network functions by bypassing authorization checks. While the direct business impact is uncertain without further context on deployment, such vulnerabilities in core network components warrant careful review to confirm relevance and exposure.
- Unprotected network functions can be accessed.
- Core network component security is a concern.
- Verify if your 5G core network is affected.
Attack Path
How an attacker could exploit the issue
An attacker who can reach the free5GC Service Based Interface (SBI) can interact with the SMF component without proper authentication. This allows them to directly access and manipulate UP (User Plane) node link configurations, potentially disrupting network operations.
- Network access to SMF required.
- Unauthenticated access to UPI endpoints.
- Unauthorized control over network links.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, a network attacker could interact with the free5GC SMF's UPI management endpoints without authentication. This could allow an attacker to read, write, or delete UPI nodes and links.
- UPI nodes and links could be affected.
- Unauthenticated network requests could expose them.
- Unauthorized management of network infrastructure may occur.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in free5GC's SMF impacts organizations deploying 5G core network functions. Responsibility likely falls to the platform or infrastructure team managing the free5GC deployment, with coordination from the network or security team responsible for securing the Service Based Interface (SBI). The first critical step is to inventory free5GC instances, assess their network exposure and business criticality, and identify the specific owner accountable for the SMF component.
- Platform/infrastructure teams own the issue.
- Verify SMF reachability and criticality.
- Plan remediation within maintenance windows.
