CVE-2023-46324
High
Description
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.
SeverityHigh
CVSS7.5
Exploit probability—
ProductFree5gc Udm
PublishedOct 23, 2023
First seenOct 23, 2023
How to fix
Update
- free5gc udm1.2.0 or later
- github.com/free5gc/udm1.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| free5gc udm | v < 1.2.0 | 1.2.0 |
| github.com/free5gc/udmGo | v < 1.2.0 | 1.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.