Ericsson Packet Core Controller up to 1.32 Access/Mobility Management Function denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in Ericsson Packet Core Controller up to 1.32. Affected by this vulnerability is an unknown functionality of the component Access/Mobility Management Function. The manipulation results in denial of service. This vulnerability is known as CVE-2024-25009. Access to the local network is required for this attack. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Ericsson Packet Core Controller up to 1.32. Affected is an unknown functionality of the component Access/Mobility Management Function. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to denial of service which may result in service degradation.

The weakness was published by Radu Balaci and Meghna Patel. The advisory is shared for download at ericsson.com. This vulnerability is traded as CVE-2024-25009 since 02/02/2024. The exploitability is told to be easy. The attack can only be done within the local network. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.33 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Ericsson

Name

• Packet Core Controller

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion