Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-47780— free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

Quick assessment

Affected
free5gc free5gc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

free5GC 是一个开源的 5G 核心网络实现。在 4.2.3 及更早版本中，free5gc/udr internal/sbi/api_datarepository.go 中的 HandleCreateEeSubscriptions 和 HandleQueryEesubscriptions 使用正则表达式验证 ueId 路径值，但其最后的 替代项接受任意非空字符串，而非将标识符限制为受支持的 SUPI 和 GPSI 格式。能够访问 UDR SBI 的攻击者可以向 提交一个非 3GPP 格式的标识符，使其通过验证并

CVSS 6.9 · Medium EPSS 0.08% · P25

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47780

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
Source: CVE Program / CVE List V5
Vulnerability Description
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing the identifier to pass validation and enter the normal create or query flow. The advisory does not independently establish whether authentication is required. Invalid identifiers can be persisted and retrieved as subscription records, enabling unauthorized data creation, UDR namespace pollution, persistent subscriber-metadata corruption, and interference with downstream components that trust stored identifiers to use valid 3GPP formats. The exposure is most relevant in lab, test, or loosely segmented service-based-interface deployments where direct UDR access is possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
free5gc free5gc <= 4.2.2 -

II. Public POCs for CVE-2026-47780

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47780

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-47780 (1)

IV. Related Vulnerabilities

Same product: free5gc
Same vendor: free5gc
Same weakness: CWE-20

V. Comments for CVE-2026-47780

No comments yet

Leave a comment