Skip to content
Threat Feed
Subscribe

Tag

NEF

3 briefs RSS
critical advisory

free5GC NEF nnef-pfdmanagement API Unauthenticated Access Vulnerability

free5GC's NEF nnef-pfdmanagement API is vulnerable to unauthenticated access, allowing attackers with network access to read PFD data and create/delete PFD subscriptions by using forged bearer tokens due to the absence of inbound OAuth2/bearer-token authorization.

nef free5GC unauthenticated access CVE-2026-44330 PFD management network security
2r 1t 4i
medium advisory

free5GC NEF PATCH Handler Vulnerability Leads to Denial of Service

A nil pointer dereference vulnerability exists in free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler when UDR access fails, causing a denial-of-service condition.

nef 4.2.1 denial-of-service vulnerability free5GC NEF CVE-2026-44322
2r 1t 3i
high advisory

free5GC NEF Unauthenticated Callback Vulnerability

free5GC NEF v4.2.1 exposes an unauthenticated callback route group, enabling attackers to forge SMF callbacks and potentially corrupt AF traffic-influence or PFD-management subscription views, leading to unauthorized policy changes.

nef:v4.2.1 +1 5G NEF Authentication Bypass CWE-306 CWE-862
2r 1t