CVE-2025-69208
📋 TL;DR
The free5GC UDR component versions prior to 1.4.1 leak internal parsing error details to remote clients through the Nnef_PfdManagement service. This information exposure vulnerability allows attackers to fingerprint server software and understand internal logic flows. All deployments using the affected service are potentially vulnerable.
💻 Affected Systems
- free5GC UDR
📦 What is this software?
Udr by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map internal server architecture, identify software versions, and use this reconnaissance to plan targeted attacks against the 5G core network.
Likely Case
Information leakage that reveals server implementation details, potentially aiding in further vulnerability discovery or targeted exploitation.
If Mitigated
With proper error handling, only generic error messages are returned, preventing information disclosure about internal server state.
🎯 Exploit Status
Exploitation requires sending malformed requests to trigger parsing errors. No authentication is required to receive the leaked error information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1
Vendor Advisory: https://github.com/free5gc/free5gc/security/advisories/GHSA-f3pc-w7jp-4jh2
Restart Required: Yes
Instructions:
1. Update free5GC UDR to version 1.4.1 or later. 2. Apply the patch from commit 91bb34bd96e1c89b3fddca80db8b90049da61ebb. 3. Restart the UDR service.
🔧 Temporary Workarounds
No application-level workaround
allThe advisory states there is no direct workaround at the application level. The only effective mitigation is patching.
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the Nnef_PfdManagement service
- Deploy a WAF or reverse proxy to filter and sanitize error responses before they reach clients
🔍 How to Verify
Check if Vulnerable:
Check if UDR version is below 1.4.1 and if Nnef_PfdManagement service is enabled. Send malformed JSON requests to the service endpoint and check if detailed parsing errors are returned.Check Version:
Check the free5GC UDR version in deployment configuration or via service logsVerify Fix Applied:
After patching, send malformed requests to the Nnef_PfdManagement service and verify only generic error messages are returned without internal parsing details.📡 Detection & Monitoring
Log Indicators:
- Detailed parsing error messages in UDR logs containing internal error details
- Multiple malformed requests to Nnef_PfdManagement endpoints
Network Indicators:
- HTTP responses containing detailed JSON parsing error messages
- Requests with malformed JSON payloads to UDR service endpoints
SIEM Query:
source="free5gc-udr" AND (message="invalid character" OR message="parsing error")