CVE-2025-69253: free5GC vulnerable to improper error handling in NEF with information exposure
free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of the User Data Repository are affected by Improper Error Handling with Information Exposure. The NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the NnefPfdManagement service may be vulnerable. free5gc/udr pull request 56 contains a patch. No direct workaround is available at the application level. Applying the official patch is recommended.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69253?
CVE-2025-69253 has been rated as a medium severity vulnerability due to improper error handling leading to potential information exposure.
How do I fix CVE-2025-69253?
To mitigate CVE-2025-69253, upgrade to free5GC versions later than 1.4.1, which include patches for this vulnerability.
What components are affected by CVE-2025-69253?
CVE-2025-69253 affects the User Data Repository (UDR) component of free5GC up to and including version 1.4.1.
What type of vulnerability is CVE-2025-69253?
CVE-2025-69253 is categorized as an improper error handling vulnerability that results in information exposure.
What impact does CVE-2025-69253 have on security?
CVE-2025-69253 may allow unauthorized access to sensitive information due to ineffective error handling in the NEF component.