Read the docs
TI-2025-42702 Aliases CVE-2025-69250

free5GC has Improper Error Handling in UDM, Leading to Information Exposure

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the service reliably leaks detailed internal error messages (e.g., strconv.ParseInt parsing errors) to remote clients when processing invalid pduSessionId inputs. This exposes implementation details and can be used for service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM DELETE service may be vulnerable. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
free5gcudmup to 1.4.1—No fix listedCNA
  • udm Vendorfree5gc Affected up to 1.4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:*up to 1.4.1Vulnerablefree5gc
  • cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* Versions up to 1.4.1 Vulnerable ·free5gc

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-69250

References

Exploit 1

Patch 3

  • TI-2026-25617 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVSS 4.0HIGH 8.7
  • TI-2026-25506 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference CVSS 4.0HIGH 8.7
  • TI-2026-25507 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVSS 4.0MEDIUM 6.9
  • TI-2026-25616 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error CVSS 4.0HIGH 8.7
  • TI-2026-22024 free5GC has Improper Input Validation in UDM UEAU Service CVSS 4.0MEDIUM 6.6
  • TI-2025-42704 free5GC has Null Pointer Dereference in UDM, Leading to Service Panic CVSS 4.0MEDIUM 6.6
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences