A missing authentication and authorization guard on free5GC’s SMF UPI management endpoints allows an attacker with network reach to the Service Specific Interface (SBI) to issue GET, POST, and DELETE requests without an Authorization header. These unauthenticated requests are processed by the SMF business handlers, enabling read of topology details, creation of new UP‑node and link entries, and deletion of existing topology objects. The weakness is captured by CWE‑306 and CWE‑862. The lack of credential checks means an attacker can directly alter the network’s topology configuration when targeting the SMF UPI routes.

The vulnerability is present in all releases of free5GC free5gc before version 4.2.2, specifically affecting the SMF component’s UPI management interface. The issue was resolved in commit e23ce97565f285eb99eed153743c62bf4c767c6e and incorporated in the 4.2.2 release.

The CVSS score of 10 indicates a critical severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly disclosed exploitation yet. Nonetheless, because any network‑reachable entity can send unauthenticated requests to the SMF SBI, the exploitation likelihood is high for environments that expose or do not adequately isolate these interfaces. Successful exploitation would permit an attacker to read sensitive network state or modify node/link relationships, potentially leading to service disruption or degradation of network availability.