Security readout for executives and security teams
Plain-English summary
CVE-2021-44109 is a remotely triggerable buffer overflow in Open5GS 2.3.6 and earlier. The documented impact is denial of service, meaning a crafted SBI request could crash or disrupt affected mobile core services. The source bundle does not provide CVSS, confirmed exploit activity, or a named fixed release.
Executive priority
Handle as a service availability risk for Open5GS environments, especially production telecom or private 5G deployments. It is not supported as an active exploitation emergency by the provided sources, but exposed affected systems should be remediated promptly.
Technical view
The vulnerability is reported in Open5GS lib/sbi/message.c. Open5GS 2.3.6 and earlier can be affected by a crafted SBI request that triggers a buffer overflow and denial of service. The provided references include a GitHub issue and a fixing commit, but no CWE, CVSS vector, or detailed affected CPE list.
Likely exposure
Exposure is most likely in environments running Open5GS 2.3.6 or earlier where SBI endpoints are reachable by untrusted systems. Business impact depends on whether Open5GS supports production telecom, lab, or private 5G services and how tightly control-plane interfaces are segmented.
Exploitation context
The source bundle states remote denial of service via crafted SBI request. It does not cite CISA KEV listing, active exploitation, public weaponization, or exploitation at scale. Treat exploit status as unconfirmed based on the provided evidence.
Researcher notes
Evidence is limited to the CVE description, GitHub issue, and fixing commit. No CVSS, CWE, or exact fixed version is included in the supplied bundle. Analysis should focus on version confirmation, SBI exposure, and whether commit d919b2744cd05abae043490f0a3dd1946c1ccb8c is included.
Mitigation direction
- Identify all Open5GS deployments and confirm running versions.
- Upgrade to an Open5GS release containing the vendor fix for the referenced commit.
- If no fixed release is confirmed, follow current Open5GS vendor guidance.
- Restrict SBI interface reachability to trusted control-plane components.
- Prioritize remediation for production or externally reachable Open5GS systems.
Validation and detection
- Check whether any Open5GS instance runs version 2.3.6 or earlier.
- Map SBI endpoint network reachability from untrusted segments.
- Review service logs for unexplained crashes or repeated malformed SBI request handling.
- Confirm the referenced fix is present in deployed Open5GS source or package builds.
- Document compensating network controls where immediate upgrade is not possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-44109 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/open5gs/open5gs/issues/1247CVE reference · x_refsource_MISC
- https://github.com/open5gs/open5gs/commit/d919b2744cd05abae043490f0a3dd1946c1ccb8cCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.