{"id":"CVE-2023-36998","aliases":["EUVD-2023-40918","GHSA-p6q2-w3w9-4cjw"],"status":"published","title":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a...","description":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.","severity":{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00377,"percentile":0.31988,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2025-01-22T00:00:00Z","modified":"2026-07-05T01:18:42Z","references":[{"url":"https://cellularsecurity.org/ransacked"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36998"},{"url":"http://nextepc.com"},{"url":"https://github.com/advisories/GHSA-p6q2-w3w9-4cjw"}],"sources":{"cve":[{"id":"CVE-2023-36998","description":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-07-05T00:53:33.593Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-40918","description":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-07-05T00:53:33Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:16.016392Z"}],"ghsa":[{"id":"GHSA-p6q2-w3w9-4cjw","title":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a...","description":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.","status":"published","published":"2025-01-22T15:32:34Z","modified":"2025-02-07T03:33:04Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:59:49.339987Z"}],"nvd":[{"id":"CVE-2023-36998","description":"The NextEPC MME \u003c= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.","status":"published","published":"2025-01-22T15:15:09.647Z","modified":"2026-07-05T01:18:42.647Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:09:20.080574Z"}]}}