7.5 CVE-2023-4884


An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication.


CWE-306 : Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302]. Chain: a digital asset management program has an undisclosed backdoor in the legacy version of a PHP script (CWE-912) that could allow an unauthenticated user to export metadata (CWE-306) TCP-based protocol in Programmable Logic Controller (PLC) has no authentication. Condition Monitor firmware uses a protocol that does not require authentication. SCADA-based protocol for bridging WAN and LAN traffic has no authentication. Safety Instrumented System uses proprietary TCP protocols with no authentication. Distributed Control System (DCS) uses a protocol that has no authentication. Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV. IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV. Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV. MFV. Access TFTP server without authentication and obtain configuration file with sensitive plaintext information. Agent software running at privileges does not authenticate incoming requests over an unprotected channel, allowing a Shatter" attack. Product enforces restrictions through a GUI but not through privileged APIs. monitor device allows access to physical UART debug port without authentication Programmable Logic Controller (PLC) does not have an authentication feature on its communication protocols.




cpe start end
Configuration 1
cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:* <= 2.4.10




id description date
No known exploits

Other (github, ...)

No known exploits


Common Attack Pattern Enumerations and Classifications

id description severity
12 Choosing Message Identifier
166 Force the System to Reset Values
216 Communication Channel Manipulation
36 Using Unpublished Interfaces or Functionality
62 Cross Site Request Forgery
Very High