free5GC’s NRF RegisterNFInstance handler accepts NF Profiles without enforcing mandatory validation rules such as UUID format, nfStatus enum values, heartBeatTimer ranges, and endpoint address constraints. This lack of input validation allows an attacker to register malicious NF profiles that the NRF stores and later returns through NFDiscover. With an attacker‑controlled profile, the NRF can redirect control‑plane signaling to arbitrary service endpoints, exposing credentials, compromising signaling integrity, and potentially causing denial of service across network functions that trust the NRF. The weakness is classified as CWE‑20 (Improper Input Validation).

The open‑source 5G core network implementation known as free5GC is affected. All releases through version 4.2.2, inclusive, contain the flaw. The problem was addressed in free5GC release 4.2.3 and subsequent versions. The vulnerability resides in the NRF component of the free5GC distribution.

The CVSS score of 9.3 indicates critical severity. EPSS data is not available, so the likelihood of exploitation remains uncertain, but the lack of input validation gives a clear attack path. An adversary with access to the NRF registration API (PUT /nnrf‑nfm/v1/nf‑instances/{nfInstanceID}) can craft arbitrary NF profiles, acquire the NRF’s stored payload, and redirect traffic. The vulnerability is not listed in CISA’s KEV catalog, suggesting there are currently no publicly known exploits, yet its high severity and the breadth of impact warrant close monitoring and swift remediation.