CVE-2025-69251
Control Character Injection in free5gc UDM Causes Info Disclosure
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| free5gc | udm | to 1.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69251 is an Improper Input Validation vulnerability in the Unified Data Management (UDM) component of free5GC, an open-source 5G core network project. The issue occurs because the UDM service does not properly validate or sanitize the ueId parameter in the Nudm_UECM service. Remote attackers can inject control characters, such as URL-encoded NUL bytes (%00), into the ueId parameter.
When these control characters are decoded, they cause internal URL parsing errors in the net/url package, resulting in an HTTP 500 Internal Server Error. This error exposes internal system implementation details and can aid attackers in fingerprinting the service. The vulnerability affects all deployments of free5GC using the UDM Nudm_UECM service up to version 1.4.1 (and version 4.0.1 as noted).
There is no direct application-level workaround, but the issue has been fixed in an official patch (pull request #76), which properly validates and sanitizes the ueId parameter to reject control characters and invalid inputs.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to cause the UDM service to fail with an internal server error (HTTP 500) when specially crafted requests with control characters in the ueId parameter are sent.
Such failures expose internal system details, including raw URLs and error messages from the Go net/url library, which can be used by attackers to fingerprint the service and potentially plan further attacks.
Additionally, the improper handling of input may lead to service disruptions or denial of service conditions, affecting the availability and reliability of the 5G core network functions relying on free5GC UDM.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending specially crafted GET requests to the UDM Nudm_UECM endpoint with the ueId parameter containing control characters such as URL-encoded NUL bytes (%00). If the system is vulnerable, it will respond with an HTTP 500 Internal Server Error indicating a failure in URL parsing due to invalid control characters.'}, {'type': 'paragraph', 'content': 'A practical detection method is to use curl or similar HTTP client tools to send a request like:'}, {'type': 'list_item', 'content': 'curl -v "http://<free5gc-udm-address>/nudm-uecm/v1/ue/%00%00%00/context-data"'}, {'type': 'paragraph', 'content': 'If the response is a 500 error with messages referencing "net/url: invalid control character", it indicates the vulnerability is present. Monitoring logs for such errors can also help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
There is no direct application-level workaround available for this vulnerability. The recommended immediate step is to apply the official patch that fixes the input validation and sanitization of the ueId parameter.
Specifically, users should upgrade to the fixed version of free5GC that includes the patch from pull request #76, which properly rejects control characters and invalid percent-encoding in the ueId parameter, returning appropriate 4xx client errors instead of internal server errors.
Until the patch is applied, monitoring for suspicious requests containing control characters and restricting access to the UDM Nudm_UECM service from untrusted sources may help reduce risk.