What’s Vulnerable › Vulnerabilities

CVE-2024-24425

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-15 · updated 2026-06-17
• Weakness: CWE-125

Description

Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

Affected products

• Magma: 1.20
• Oai Epc Federation: 1.20

References

• https://cellularsecurity.org/ransacked
• https://github.com/OPENAIRINTERFACE/openair-epc-fed
• https://github.com/magma/magma

Get alerted when CVE-2024-24425 or the next vulnerability affects your stack