PT-2026-21593

CVE-2026-27643

Published

2026-02-24

Updated

2026-02-25

Description by

CVSS 4.0

6.6

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.2

Description The free5GC UDR component, a user data repository for 5G mobile core networks, exhibits an information disclosure issue. The NEF component reveals internal parsing error details to remote clients, potentially aiding attackers in service fingerprinting. This affects all deployments of free5GC utilizing the Nnef PfdManagement service. The issue stems from the reliable leakage of parsing errors, such as invalid characters, to external entities.

Recommendations Apply the patch available in free5gc/udr pull request 56.

Exploitability

Exploit

Fix

Impacts

Researchers

Zfei10990-Cmd

Vendors

Affected products

Weakness enumeration

CWE-209: Generation of Error Message Containing Sensitive Information

Related identifiers