What’s Vulnerable › Vulnerabilities

CVE-2022-35503

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-22 · updated 2026-06-17
• Weakness: CWE-77

Description

Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descriptor. An attacker may be able execute code to change the normal execution of the OSM components, retrieve confidential information, or gain access other parts of a Telco Operator infrastructure other than OSM itself.

Affected products

• Osm N2Vc: from 7 through 12

References

• https://osm.etsi.org/
• https://osm.etsi.org/news-events/blog/83-cve-2022-35503-disclosure
• https://osm.etsi.org/
• https://osm.etsi.org/news-events/blog/83-cve-2022-35503-disclosure

Get alerted when CVE-2022-35503 or the next vulnerability affects your stack