← Vulnerability feed

Vulnerability record · CVE-2025-69251 · published 24 February 2026

CVE-2025-69251: Free5gc udm improper input validation vulnerability

Free5gc · Udm

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, remote attackers can inject control characters (e.g., %00) into the ueId parameter, triggering internal URL parsing errors (net/url: invalid control character). This exposes system implementation details and can aid in service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM service may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

6.6 CVSS 4.0 Medium EPSS 0.48% · top 61.1% CWE-20 · Improper input validation
6.6CVSS 4.0 base score
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, remote attackers can inject control characters (e.g., %00) into the ueId parameter, triggering internal URL parsing errors (net/url: invalid control character). This exposes system implementation details and can aid in service fingerprinting. All deployments of free5GC using the UDM Nudm_UECM service may be affected. free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/free5gc/free5gc/issues/751 ExploitIssue TrackingVendor Advisory
https://github.com/free5gc/free5gc/issues/76 ExploitIssue TrackingVendor Advisory
https://github.com/free5gc/free5gc/security/advisories/GHSA-pwxh-4qh4-hgpq Vendor Advisory
https://github.com/free5gc/udm/commit/504b14458d156558b3c0ade7107b86b3d5e72998 Patch

Track CVE-2025-69251 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-33192Free5gc udm error message information leak vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly conv…EPSS 0.40%8.7CVE-2026-33064Free5gc udm null pointer dereference vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure …EPSS 0.78%8.7CVE-2026-33191Free5gc udm vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte …EPSS 0.58%7.5CVE-2023-46324Free5gc udm improper verification of cryptographic signature vulnerabilitypkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via …EPSS 0.41%6.9CVE-2026-33065Free5gc udm error message information leak vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly conv…EPSS 0.43%6.6CVE-2026-27642Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.65%6.6CVE-2025-69250Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.41%6.6CVE-2025-69252Free5gc udm null pointer dereference vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to a…EPSS 0.53%

Source: NIST National Vulnerability Database (record CVE-2025-69251), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.