Improper input validation in Free5gc Udm
CVE-2025-69250
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the service reliably leaks detailed internal error messages (e.g., strconv.ParseInt parsing errors) to remote clients when processing invalid pduSessionId inputs. This exposes implementation details and can be used for service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM DELETE service may be vulnerable. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Free5gc Udm — versions <= 1.4.1
Weakness classification (CWE)
References
- github.com/free5gc/free5gc/security/advisories/GHSA-6w77-5pqh-83rm (Patch, Vendor Advisory)
- github.com/free5gc/free5gc/issues/750 (Exploit, Issue Tracking, Vendor Advisory)
- github.com/free5gc/udm/pull/76 (Patch, Issue Tracking)
- github.com/free5gc/udm/commit/504b14458d156558b3c0ade7107b86b3d5e72998 (Patch)
Frequently asked questions
- What is CVE-2025-69250?
- CVE-2025-69250 is a high-severity vulnerability in Free5gc Udm, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-02-24.
- How severe is CVE-2025-69250?
- High severity. CVSS v3 base score is 7.5 out of 10.