← Back to CVE List

CVE-2023-36998

Published: 2025-01-22T15:15Z
Last Modified: 2025-02-06T22:15Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt