The SMF component in free5GC, before version 4.2.2, exposes its UPI management routes without OAuth2 middleware. A single unauthenticated POST request to /upi/v1/upNodesLinks containing attacker‑controlled JSON can trigger a logger.Fatalf call during validation. When the request creates a UPF whose IP pool overlaps an existing one, this fatal call terminates the entire SMF process. The result is a loss of all SMF services, effectively causing a denial of service rather than code execution. The vulnerability has a CVSS score of 7.5 and allows unauthenticated, network‑reachable attackers to disrupt the core network.

This weakness affects the SMF module in the free5GC open‑source 5G core network implementation. All installations running any free5GC version earlier than 4.2.2 are vulnerable; the issue is fixed in free5GC version 4.2.2.

Because the UPI endpoint is publicly reachable and requires no authentication, an attacker can exploit this flaw from anywhere on the network that can reach the SMF. The exploit simply sends a crafted POST request that results in a fatal error, immediately shutting down the SMF process. This severes service for any applications or networks relying on the SMF. The KEV listing does not include this CVE, and its moderate severity indicates a significant risk for operational environments.