CVE-2026-4240

low-risk
Published 2026-03-16

A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Open5Gs

References (8)

Product https://github.com/open5gs/open5gs/
Patch https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012...
Issue Tracking https://github.com/open5gs/open5gs/issues/4343
Exploit https://github.com/open5gs/open5gs/issues/4343#issue-4021871895
Release Notes https://github.com/open5gs/open5gs/releases/tag/v2.7.7
Permissions Required https://vuldb.com/?ctiid.351182
Third Party Advisory https://vuldb.com/?id.351182
Exploit https://vuldb.com/?submit.771361
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal