CVE-2026-30080

OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78	Exploit Issue Tracking Third Party Advisory
https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openairinterface:oai-cn5g-amf:2.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-08 17:21

Updated : 2026-07-25 10:10

NVD link : CVE-2026-30080

Mitre link : CVE-2026-30080

CVE.ORG link : CVE-2026-30080

JSON object : View

Products Affected

openairinterface

oai-cn5g-amf

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2026-30080", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30080", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T20:44:07.722198Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-04-08T17:21:18.623", "references": [{"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack."}, {"lang": "es", "value": "OpenAirInterface v2.2.0 acepta el Modo de Seguridad Completo sin ninguna protecci\u00f3n de integridad. La configuraci\u00f3n ha soportado integridad NIA1 y NIA2. Pero si un UE env\u00eda una solicitud de registro inicial con solo la capacidad de seguridad IA0, OpenAirInterface acepta y procede. Este contexto de seguridad degradado puede llevar a la posibilidad de un ataque de repetici\u00f3n."}], "lastModified": "2026-07-25T10:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openairinterface:oai-cn5g-amf:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BB4900E-B5A7-40ED-8DA6-4E372D5036D9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}