Hardcoded-Keys - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/hardcoded-keys/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:25:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgfree5gc: Root CA Private Key Exposure (CVE-2026-115925)https://feed.craftedsignal.io/briefs/2026-10-free5gc-ca-exposure/Thu, 29 Oct 2026 21:25:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-free5gc-ca-exposure/The free5gc core network implementation ships with a hard-coded Root CA private key, enabling attackers to forge certificates for network function impersonation in HTTPS-enabled environments.The free5gc repository includes a hard-coded Root CA private key located at 'cert/root.key' and 'NFs/bsf/cert/root.key'. While the vulnerability is dormant in default configurations that use HTTP, the key becomes the active trust anchor for network function (NF) to network function (NF) mTLS when operators enable HTTPS to harden the Service Based Architecture (SBI). This allows an attacker to forge certificates and perform Man-in-the-Middle (MITM) attacks. No patches are currently available; remediation requires manual rotation of the CA.

Impact

Successful exploitation allows an attacker to gain full control over the PKI trust chain, facilitating the impersonation of any network function within the 5G core. This results in complete compromise of confidentiality and integrity for inter-NF traffic.

Recommendation

  • Identify all free5gc deployments within your environment, specifically those configured to use HTTPS/mTLS for the Service Based Architecture (SBI).
  • Immediately rotate the Root CA for all affected deployments; do not rely on the default keys provided in the source repository.
  • Apply strict access control policies to the filesystem where the free5gc certificate store resides to prevent unauthorized extraction of the 'root.key' file.
  • Implement a manual certificate rotation procedure that generates unique keys per deployment rather than utilizing the static key provided by the vendor.
]]>highadvisorysupply-chain5gcryptographic-vulnerabilityhardcoded-keys