Executive brief
The Network Exposure Function (NEF) in the free5GC 5G core network contains a security flaw where a critical management interface is left unprotected. This component is responsible for exposing network capabilities to external applications. An attacker can use this flaw to manipulate network policies, potentially redirecting or intercepting mobile traffic, and can also delete legitimate network configurations, leading to service outages.
Technical details
The free5GC Network Exposure Function (NEF) fails to implement inbound authentication (CWE-306) and authorization (CWE-862) for the 3gpp-pfd-management API. The route group is mounted without middleware to validate OAuth2 bearer tokens, meaning any arbitrary or forged token is accepted. This allows a network-adjacent or remote attacker with access to the Service Based Interface (SBI) to perform CRUD operations on Packet Flow Description (PFD) transactions. These transactions are written to the Unified Data Repository (UDR) and used by the Session Management Function (SMF) and User Plane Function (UPF) for traffic classification, enabling policy poisoning or denial of service. The vulnerability persists even if the service is not explicitly declared in the configuration's ServiceList.
Affected products
- free5GC nef <= 1.2.3
- free5GC free5GC <= v4.2.1
Timeline
- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD publication date