Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because the nnef-callback route group in free5GC's NEF was configured without an authentication middleware. This allowed unauthenticated access to the API endpoints within this group. The analysis of the provided information, including the vulnerability description, PoC, and the fixing pull request, confirms this. The PoC targets the /nnef-callback/v1/notification/smf endpoint. The logs from the PoC show that the request reaches the SmfNotification handler, which is part of the business logic. The fixing commit b93716c4a004fa91705d6ce62a860bb3fefc2075 introduces an authentication middleware in internal/sbi/server.go for the nnef-callback group. The vulnerable functions are the API handler Server.SmfNotification which is the entry point, and the business logic function Processor.SmfNotification which processes the unauthenticated data. The NewServer function is also included as it is where the insecure configuration was present.
Server.SmfNotificationinternal/sbi/api_callback.go
Processor.SmfNotificationinternal/sbi/processor/callback.go
NewServerinternal/sbi/server.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/nef | go | <= 1.2.3 |