free5GC's Network Exposure Function exposes the 3gpp‑traffic‑influence API without bearer‑token authentication until version 4.2.2. An attacker who can reach the NEF over the SBI can send requests that create, read, patch, or delete traffic‑influence subscriptions with no Authorization header or with a forged token, including AnyUeInd subscriptions that can affect group or any‑UE traffic steering. As a result, an attacker can alter traffic steering for any UE or any group of UEs without having valid credentials.

Affected vendor is free5GC, specifically the free5gc product prior to release 4.2.2. Any installation of free5GC older than or equal to 4.2.1 is exposed. No specific sub‑version ranges beyond the mention of 4.2.2 as the fixing release are provided.

The vulnerability carries a CVSS score of 9.4, indicating a high‑severity flaw that can lead to unauthorized system‑level control. EPSS data are not available, and the issue has not been listed in the CISA KEV catalog. The attack can be performed over the network by an adversary who can reach NEF’s SBI interface; no local privilege or code execution is required. Because the API is reachable even when the ServiceList configuration does not declare it, operators may assume the service is disabled when it is not, further increasing the risk. Until a patch is applied, this represents a significant security exposure that can be exploited by internal or external actors with network access.