Security readout for executives and security teams
Plain-English summary
Open5GS installations through 2.7.1 may contain a remotely reachable memory-safety flaw in the PCRF Diameter Rx handler. Crafted input can overflow a buffer, potentially disrupting service or affecting data confidentiality and integrity. A public proof of concept exists, but the supplied sources do not establish active exploitation.
Executive priority
Prioritize an expedited upgrade for reachable production PCRF systems because proof-of-concept material is public and memory corruption can affect service and data. Treat isolated or unused Rx handlers through the normal patch process after confirming exposure. There is no supplied evidence of active exploitation.
Technical view
The flaw is in pcrf_rx_aar_cb within src/pcrf/pcrf-rx-path.c. Manipulating num_of_media_component or num_of_sub can trigger a buffer overflow. The supplied CVSS v2 score is 6.5, with network access and authenticated-session requirements. Version 2.7.2 and commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7 are identified as corrective.
Likely exposure
Exposure is most likely where Open5GS PCRF Diameter Rx functionality through 2.7.1 is enabled and reachable by a capable authenticated network participant. Internet exposure is not required. The bundle inconsistently lists 2.7.2 as affected while also identifying it as fixed, so build-level verification is important.
Exploitation context
A public capture associated with the issue is tagged as exploit material, supporting proof-of-concept availability. Remote initiation is reported, but the CVSS vector indicates authentication is required. The CVE is not listed in KEV, and no supplied source confirms exploitation in operational environments.
Researcher notes
Version data is internally inconsistent: the affected list includes 2.7.2, while the description, patch, and release identify 2.7.2 as corrective. Researchers should compare exact build provenance against the cited commit. The supplied evidence establishes a buffer overflow and public proof of concept, but not reliable code execution or observed attacks.
Mitigation direction
- Upgrade affected Open5GS deployments to version 2.7.2 or a later vendor-supported release.
- Confirm custom or backported builds include commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7.
- Temporarily restrict Diameter Rx connectivity to necessary, trusted peers.
- Check current Open5GS guidance if version applicability remains uncertain.
Validation and detection
- Inventory Open5GS versions and identify systems running PCRF Diameter Rx functionality.
- Verify deployed source or package metadata includes the cited corrective commit.
- Confirm Diameter Rx endpoints are accessible only from authorized network peers.
- Review PCRF crashes and memory-fault events; supplied sources provide no confirmed detection signature.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-14044 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C86.4VulDBCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Base CVSS 3.0 score
6.3MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-387282 | Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflowCVE reference, VulDB · vdb-entry, technical-description
- VDB-387282 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2024-14044 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #867117 | Open5GS v2.7.2 Memory CorruptionCVE reference, VulDB · third-party-advisory
- https://github.com/open5gs/open5gs/issues/3157CVE reference, VulDB · issue-tracking
- https://github.com/open5gs/open5gs/files/15051247/capture.pcap.gzCVE reference, VulDB · exploit
- https://github.com/open5gs/open5gs/commit/87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7CVE reference, VulDB · patch
- https://github.com/open5gs/open5gs/releases/tag/v2.7.2CVE reference, VulDB · patch
- https://github.com/open5gs/open5gs/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.