A flaw in Free5GC SMF’s PFCP handler allows an attacker to craft a PFCP Session Report request that causes the HandlePfcpSessionReportRequest function to crash, resulting in a denial of service. The vulnerability does not directly expose sensitive data or credentials, but it can take the core network’s Session Management Function offline. The advisory notes that the exploit can be executed remotely and has already been publicly disclosed.

Free5GC SMF versions up to 4.1.0 are affected. The issue resides in the internal/pfcp/handler/handler.go file, specifically the HandlePfcpSessionReportRequest routine. No other Free5GC components or vendors are listed as impacted.

The CVSS score of 6.9 reflects a moderate severity, and the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not part of the CISA KEV catalog, but because it can be triggered by external traffic sent to the SMF, the risk to availability remains significant. Attackers would need to target the SMF’s PFCP interface, and those already have the means to do so. Prompt patching is therefore advised to mitigate the risk.