Weiyi

**Name of the Vulnerable Software and Affected Versions** Open5GS version 2.8.0 **Description** An out-of-bounds read can be triggered remotely within the Rx AA-Request Handler component. The issue resides in the `pcrf rx aar cb()` function located in the `src/pcrf/pcrf-rx-path.c` file. **Recommendations** Deploy patch c18dc6938bf63cc7374315d3dca303d92066e746 for version 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.8.1 **Description** A flaw in the HSS component within the file `src/hss/hss-cx-path.c` allows a remote attacker to cause a reachable assertion. This occurs through the manipulation of the `User-Name` argument. **Recommendations** Apply patch c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Open5GS version 2.8.0 **Description** A remote heap-based buffer overflow exists in the S6a Authentication-Information-Request Handler component. The issue occurs within the `hss ogs diam s6a air cb()` function located in the `src/hss/hss-s6a-path.c` file. This flaw can be triggered by manipulating the `Visited-PLMN-Id` argument. **Recommendations** Apply patch a9c82ee0b590d76a581b0580cb46b598984e2392 to version 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.2 **Description** A flaw in the freeDiameter component allows for remote memory corruption. Memory corruption occurs when a program unintentionally modifies the contents of a memory location, which can lead to crashes or unauthorized code execution. **Recommendations** Update to a version newer than 2.7.1.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.7 **Description** A security flaw in the SMF Diameter Gx Credit-Control-Answer Handler allows a remote attacker to cause a denial of service. The issue resides in the `smf gx cca cb()` function. **Recommendations** Update to version 2.7.7. As a temporary mitigation, restrict access to the SMF Diameter Gx Credit-Control-Answer Handler component.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.7 **Description** A remote denial of service issue exists in the HSS Service component. The problem occurs within the `fd msg sess get()` function when the `Session-Id` argument is manipulated. **Recommendations** Update Open5GS to a version newer than 2.7.6. As a temporary workaround, restrict access to the HSS Service component to minimize the risk of remote exploitation.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.2 **Description** A remote buffer overflow exists in the Diameter Rx Handler component within the `pcrf rx aar cb()` function of the `src/pcrf/pcrf-rx-path.c` file. This issue occurs when the `num of media component` or `num of sub` arguments are manipulated. **Recommendations** Upgrade to version 2.7.2. As a temporary mitigation, restrict access to the Diameter Rx Handler component to minimize the risk of remote exploitation.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.7 **Description** A remote attack can trigger a reachable assertion within the CER Handler component. The issue resides in the `diam log func()` function located in the `lib/diameter/common/init.c` file. **Recommendations** Upgrade to version 2.7.7. As a temporary mitigation, restrict access to the CER Handler component to minimize the risk of remote exploitation.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.2 **Description** A stack-based buffer overflow exists in the Diameter S6a Interface component within the `hss ogs diam s6a air cb()` and `hss ogs diam s6a ulr cb()` functions of the `src/hss/hss-s6a-path.c` file. This issue can be triggered remotely by manipulating the `os.len` argument. **Recommendations** Upgrade to version 2.7.2.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions prior to 2.7.2 **Description** A heap-based buffer overflow exists in the Diameter S6a Interface component within the `mme s6a subscription data from avp()` function of the `src/mme/mme-fd-path.c` file. This issue can be triggered remotely by manipulating the `msisdn len` argument. **Recommendations** Update to version 2.7.2. As a temporary mitigation, restrict access to the Diameter S6a Interface component to minimize the risk of remote exploitation.