PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30080 Openairinterface CVE debrief

OpenAirInterface v2.2.0 has a vulnerability where it accepts Security Mode Complete without any integrity protection. The configuration supports integrity NIA1 and NIA2, but if a user equipment (UE) sends an initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade in security context can lead to the possibility of replay attacks. The vulnerability class is related to integrity protection, and the likely operational impact is a replay attack. The source confidence is limited, and the review context is based on the CVE record and NVD entry.

Vendor
Openairinterface
Product
Oai-Cn5g-Amf
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-25
Advisory published
2026-04-08
Advisory updated
2026-07-25

Who should care

Organizations using OpenAirInterface v2.2.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Technical summary

The vulnerability is caused by OpenAirInterface v2.2.0 accepting Security Mode Complete without integrity protection. The configuration supports integrity NIA1 and NIA2, but if a UE sends an initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade in security context can lead to the possibility of replay attacks. The affected product is OpenAirInterface v2.2.0, and the defensive impact is highly critical due to the potential for replay attacks.

Defensive priority

Highly Critical

Recommended defensive actions

  • Review and update OpenAirInterface configuration to enforce integrity protection
  • Verify user equipment (UE) security capabilities and ensure they align with OpenAirInterface configuration
  • Monitor for potential replay attacks and implement additional security measures as needed
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-08T17:21:18.623Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. The vulnerability affects OpenAirInterface v2.2.0 and has a CVSS score of 7.5. The configuration supports integrity NIA1 and NIA2, but if a user equipment (UE) sends an initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade in security context can lead to the possibility of replay attacks. The evidence is limited, and defenders should verify the affected scope and severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T17:21:18.623Z and has not been modified since then. The NVD entry is currently Analyzed.