How severe is CVE-2023-37017?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.6 out of 10.

What type of vulnerability is CVE-2023-37017?

This is classified as CWE-617, which is a common weakness in software security.

CVE-2023-37017 - HIGH Severity | CVSS 8.6

Vulnerability Description

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `S1Setup Request` message missing a required `Global eNB ID` field to repeatedly crash the MME, resulting in denial of service.

Related Vulnerabilities

CVE-2023-37015

HIGH

CVSS:8.6(High)

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Path Switch Request` message missing a ...

CWE-6172023

CVE-2023-37016

HIGH

CVSS:8.6(High)

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Response` messag...

CWE-6172023

CVE-2023-37018

HIGH

CVSS:8.6(High)

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Capability Info Indication` message ...

CWE-6172023

CVE-2023-37019

HIGH

CVSS:8.6(High)

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `S1Setup Request` message missing a req...

CWE-6172023

CVE-2023-37020

HIGH

CVSS:8.6(High)

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Complete` message mis...

CWE-6172023

CVE-2023-37021

HIGH

CVSS:8.6(High)

Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Failure` message...

CWE-6172023