CVE-2026-30080: High severity openairinterface OpenAirInterface vulnerability
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30080?
CVE-2026-30080 is classified with a moderate severity due to the potential for downgraded security leading to vulnerabilities.
How do I fix CVE-2026-30080?
To fix CVE-2026-30080, ensure that only security capabilities IA1 or IA2 are accepted during initial registration requests.
What systems are affected by CVE-2026-30080?
CVE-2026-30080 affects OpenAirInterface version 2.2.0 and its components.
What is the risk of not addressing CVE-2026-30080?
Failing to address CVE-2026-30080 could result in compromised integrity protection during security mode signaling.
Can CVE-2026-30080 be exploited remotely?
Yes, CVE-2026-30080 can be exploited remotely if unauthorized users can send specific registration requests.