What is CVE-2023-37008?

CVE-2023-37008 is a medium-severity vulnerability in Open5gs, classified under Reachable Assertion. CVSS score: 5.3/10. Published 2025-01-22.

How severe is CVE-2023-37008?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Open5gs

CVE-2023-37008

Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid parsing and freeing of memory. An attacker may use this to crash an MME or potentially execute code in certain circumstances.

EPSS: 0.003 (20.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Open5gs
N/a — versions n/a

Weakness classification (CWE)

CWE-617 — Reachable Assertion

References

cve@mitre.org (Technical Description, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-37008?: CVE-2023-37008 is a medium-severity vulnerability in Open5gs, classified under Reachable Assertion. CVSS score: 5.3/10. Published 2025-01-22.
How severe is CVE-2023-37008?: Medium severity. CVSS v3 base score is 5.3 out of 10.