Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-37033: Magma Mobile Management Entity Crashes with Missing S1AP Packet

CVE-2023-37033 · published 1 year ago

Summary

If an attacker sends a specific type of packet to a Magma Mobile Management Entity, it can cause the Magma service to crash. This can lead to downtime and impact network operations. To resolve this issue, update Magma to version 1.9 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
linuxfoundation	magma	<= 1.8.0 `cpe:2.3:a:linuxfoundation:magma::::::::`

Original advisory text

A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Initial UE Message` packet missing an expected `EUTRAN_CGI` field.

References

https://cellularsecurity.org/ransacked URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37033... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-37033 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published21 Jan 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2023-37033 · NVD

CVE-2023-37033 · OSV

Track software like this

Free during beta