CVE-2021-28122

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-10 · updated 2026-06-17
Weakness: CWE-306

Description

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

Affected products

Open5GS: from 2.1.3 through 2.2.0

References

https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1
https://github.com/open5gs/open5gs/issues/837
https://github.com/open5gs/open5gs/pull/838
https://github.com/open5gs/open5gs/releases
https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1
https://github.com/open5gs/open5gs/issues/837
https://github.com/open5gs/open5gs/pull/838
https://github.com/open5gs/open5gs/releases

Get alerted when CVE-2021-28122 or the next vulnerability affects your stack