CVE-2023-36998

The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cellularsecurity.org/ransacked

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-22 15:15

Updated : 2026-07-05 01:18

NVD link : CVE-2023-36998

Mitre link : CVE-2023-36998

CVE.ORG link : CVE-2023-36998

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2023-36998", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-36998", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-02-03T14:01:42.590920Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-01-22T15:15:09.647", "references": [{"url": "https://cellularsecurity.org/ransacked", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core."}, {"lang": "es", "value": "El MME NextEPC <= 1.0.1 (corregido en commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en el m\u00e9todo de decodificaci\u00f3n de la lista de n\u00fameros de emergencia. Un atacante puede enviar un mensaje NAS que contenga un valor de lista de n\u00fameros de emergencia de gran tama\u00f1o al MME para sobrescribir la pila con bytes arbitrarios. Un atacante con una conexi\u00f3n de tel\u00e9fono celular a cualquier estaci\u00f3n base administrada por el MME puede explotar esta vulnerabilidad sin tener que autenticarse con el n\u00facleo LTE."}], "lastModified": "2026-07-05T01:18:42.647", "sourceIdentifier": "cve@mitre.org"}