The vulnerability arises because the AMF in free5gc does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. While a Network‑to‑Node B handover is in progress, an attacker could trigger a NAS Security Mode Command, or vice versa, without the AMF verifying that the other security procedure is not active. This oversight can cause the NAS and Authentication Server (AS) security contexts to diverge for the same user equipment, potentially weakening the cryptographic protection of GTP bearer traffic and undermining the integrity and confidentiality guarantees of the session.

Affected systems are installations of the free5gc open‑source 5G core network, specifically the AMF component. Versions prior to 4.2.2 are vulnerable; the fix is included in free5gc 4.2.2 and later releases.

With a CVSS score of 3.7, the vulnerability is classified as low severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be internal or in‑network, requiring an adversary with the ability to initiate or influence NGAP handover procedures within a free5gc deployment. Given the limited public exploitation evidence, the practical risk is moderate, but the mismatched security contexts could still be leveraged by a determined attacker to degrade session security.