← Vulnerability feed

Vulnerability record · CVE-2021-28122 · published 10 March 2021

CVE-2021-28122: Open5gs missing authentication for critical function vulnerability

Open5gs · Open5gs

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

9.8 CVSS 3.1 Critical EPSS 4.0% · top 9.9% CWE-306 · Missing authentication for critical function
9.8CVSS 3.1 base score, v2 7.5
4.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1 PatchThird Party Advisory
https://github.com/open5gs/open5gs/issues/837 ExploitThird Party Advisory
https://github.com/open5gs/open5gs/pull/838 PatchThird Party Advisory
https://github.com/open5gs/open5gs/releases Release NotesThird Party Advisory
https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1 PatchThird Party Advisory
https://github.com/open5gs/open5gs/issues/837 ExploitThird Party Advisory
https://github.com/open5gs/open5gs/pull/838 PatchThird Party Advisory
https://github.com/open5gs/open5gs/releases Release NotesThird Party Advisory

Track CVE-2021-28122 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-40129Open5gs out-of-bounds write vulnerabilityOpen5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.EPSS 0.46%9.8CVE-2024-40130Open5gs out-of-bounds write vulnerabilityopen5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c.EPSS 0.64%8.8CVE-2021-25863Open5gs improper authentication vulnerabilityOpen5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.EPSS 1.2%8.7CVE-2025-41068Open5gs vulnerabilityReachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is …EPSS 0.36%8.7CVE-2025-41067Open5gs vulnerabilityReachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI r…EPSS 0.43%8.6CVE-2024-24429Open5gs vulnerabilityA reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted N…EPSS 0.56%8.6CVE-2024-34235Open5gs vulnerabilityOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker …EPSS 0.78%8.6CVE-2023-37015Open5gs vulnerabilityOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker …EPSS 0.78%

Source: NIST National Vulnerability Database (record CVE-2021-28122), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.