Security readout for executives and security teams
Plain-English summary
A remotely reachable flaw in Open5GS can let malformed Diameter S6a data overflow memory in the HSS process. This could cause service disruption or affect data and system integrity. Public proof-of-concept material exists, but the supplied sources do not establish active exploitation.
Executive priority
Schedule prompt remediation for exposed telecom-core deployments, especially HSS systems reachable by multiple Diameter peers. The rating is moderate rather than critical because authentication is indicated and active exploitation is unconfirmed. Public proof-of-concept availability increases urgency. Resolve the conflicting 2.7.2 version data during change validation.
Technical view
Manipulating os.len in hss_ogs_diam_s6a_air_cb or hss_ogs_diam_s6a_ulr_cb within src/hss/hss-s6a-path.c can cause a stack-based buffer overflow. The supplied CVSS v2 assessment is 6.5 and indicates network access with authentication. Commit e89aa79efe629ae90f59dcdf8847c117d9a7da86 addresses the issue.
Likely exposure
Exposure is most likely where an affected Open5GS HSS accepts Diameter S6a traffic from reachable or insufficiently restricted peers. The narrative identifies versions through 2.7.1 as vulnerable. The structured affected list also includes 2.7.2, conflicting with the stated fixed release, so patch status should be verified directly.
Exploitation context
A public packet capture or proof-of-concept is referenced, making reproduction more accessible. Remote initiation is reported, although the CVSS vector indicates some authentication is required. The bundle marks KEV false and provides no evidence of active exploitation in production.
Researcher notes
The source bundle maps the flaw to CWE-119 and CWE-121 and reports partial confidentiality, integrity, and availability impact. It does not establish reliable code execution, observed attacks, or specific indicators. The version metadata is internally inconsistent: narrative and release references call 2.7.2 fixed, while the affected array includes it.
Mitigation direction
- Upgrade Open5GS to version 2.7.2 or later, following vendor release guidance.
- Confirm commit e89aa79efe629ae90f59dcdf8847c117d9a7da86 is present in custom or backported builds.
- Restrict Diameter S6a access to authorized, trusted peers using existing network and peer controls.
- Prioritize HSS availability protections and monitoring until remediation is confirmed.
Validation and detection
- Inventory Open5GS HSS versions and identify deployments running 2.7.1 or earlier.
- Verify the installed source or package contains the named corrective commit.
- Review Diameter S6a reachability and confirm only authorized peers can connect.
- Check HSS crash, restart, and memory-fault records for unexplained events.
- Run approved defensive regression tests after upgrading; do not use production systems for proof-of-concept testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-14042 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C86.4VulDBCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Base CVSS 3.0 score
6.3MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-387280 | Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflowCVE reference, VulDB · vdb-entry, technical-description
- VDB-387280 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2024-14042 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #867105 | Open5GS v2.7.2 Memory CorruptionCVE reference, VulDB · third-party-advisory
- https://github.com/open5gs/open5gs/issues/3155CVE reference, VulDB · issue-tracking
- https://github.com/open5gs/open5gs/files/15051218/capture.pcap.gzCVE reference, VulDB · exploit
- https://github.com/open5gs/open5gs/commit/e89aa79efe629ae90f59dcdf8847c117d9a7da86CVE reference, VulDB · patch
- https://github.com/open5gs/open5gs/releases/tag/v2.7.2CVE reference, VulDB · patch
- https://github.com/open5gs/open5gs/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.