Executive brief
The VES Collector component in O-RAN-SC SMO OAM is vulnerable to a denial-of-service attack through resource exhaustion. An attacker can send crafted heartbeat events from multiple sources to overwhelm the collector and disrupt its ability to receive legitimate telemetry data, affecting network monitoring and management capabilities across the O-RAN infrastructure.
Technical details
The vulnerability is a CWE-770 (allocation of resources without limits) in the VES Collector component of O-RAN-SC SMO OAM 2025-06-10. An attacker can conduct a low-and-slow distributed denial-of-service attack by sending a high volume of heartbeat events with varying source identifiers and sequence numbers to the VES event listener endpoint (port 8080/eventListener/v7). The attack is network-accessible and requires no authentication. By maintaining many concurrent connections and sending events at controlled intervals, an attacker can exhaust the collector's memory and processing capacity, preventing it from handling legitimate monitoring events. Patches or vendor mitigations were not available at the time of advisory publication.
Affected products
- O-RAN-SC SMO OAM 2025-06-10
Timeline
- 2026-09-18: disclosed
- other: Exploit proof-of-concept made public; vendor informed via bug report with no response