Oh No, My RAN! Breaking Into an O-RAN 5G Indoor Base Station
summary
Assessment targets an Air Velocity 2700 indoor radio unit reachable with simple Ethernet (C1 capability). Recon finds four vulnerabilities: a broadcasting port 1534 TCF agent that reveals a root terminal, an unintended SSH shell, an unauthenticated Mosquitto management channel with memory‑corruption bugs (crash -> DoS), and a command‑injection that yields remote code execution (five usable bytes of input). Exploits allow full RU control, persistent reconfiguration of transmit power, and lateral escalation risks toward DU/CU or SMO.
AI-written summary · about
chapters (12)
- 0:00Breaking into O-RAN
- 1:35What is O-RAN
- 3:02Indoor base stations matter
- 4:27System model and threats
- 6:15Airspan radio unit
- 8:21Open ports and access
- 10:53Communication Framework flaws
- 12:18Calish agent risks
- 13:02Mosquitto memory flaws
- 14:29Full radio unit impact
- 15:54Findings and standards issues
- 16:34Takeaways and future work
related talks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
44mNew Vulnerabilities in 5G Networks
55mAttacking Industrial Remote Controllers
44mExposing Critical Threats In Millions Of Connected Devices
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
33mHacking 5G From Radio Security To The Apis
44m"Attacking industrial remote controllers for fun and profit"
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem