CVE-2025-66719
📋 TL;DR
This vulnerability in Free5gc NRF 1.4.0 allows attackers to bypass scope validation during access token generation by using a crafted targetNF value. This enables unauthorized access tokens with arbitrary scopes, potentially compromising the entire 5G core network. Organizations running Free5gc NRF 1.4.0 are affected.
💻 Affected Systems
- Free5gc NRF
📦 What is this software?
Nrf by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of 5G core network functions, allowing attackers to intercept/modify communications, impersonate network functions, or disrupt service availability.
Likely Case
Unauthorized access to sensitive network functions, privilege escalation within the 5G core, and potential data exfiltration.
If Mitigated
Limited impact if proper network segmentation and monitoring are in place, but authentication bypass remains possible.
🎯 Exploit Status
Exploitation requires network access to NRF service but authentication bypass is straightforward once access is obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in NRF version after pull request #73
Vendor Advisory: https://github.com/free5gc/free5gc/issues/736
Restart Required: Yes
Instructions:
1. Update Free5gc NRF to latest version 2. Restart NRF service 3. Verify fix with test requests
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to NRF service to only authorized network functions
iptables -A INPUT -p tcp --dport 29510 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 29510 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit NRF exposure
- Deploy WAF or API gateway with request validation for targetNF parameter
🔍 How to Verify
Check if Vulnerable:
Check NRF version: grep 'version' /path/to/nrf/config or check running process versionCheck Version:
free5gc-nrf --versionVerify Fix Applied:
Test access token requests with various targetNF values and verify scope validation works📡 Detection & Monitoring
Log Indicators:
- Unusual access token requests
- Multiple failed scope validations
- Requests with malformed targetNF values
Network Indicators:
- Abnormal NRF API call patterns
- Unexpected access token generation frequency
SIEM Query:
source="nrf.log" AND ("AccessTokenScopeCheck" OR "targetNF") AND status="success"