Search
Find a vulnerability
Search criteria
8 vulnerabilities found for SMO OAM by O-RAN-SC
CVE-2026-93310 (GCVE-0-2026-93310)
Vulnerability from nvd – Published: 2026-09-18 00:00 – Updated: 2026-09-18 19:59
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406596 | vdb-entry |
| https://vuldb.com/vuln/406596/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93310 | third-party-advisory |
| https://vuldb.com/submit/942313 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-204 | related |
| https://gist.github.com/fklement/f70321f38513c2e8… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93310",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:59:23.029478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:59:33.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T00:00:12.701Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406596 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406596"
},
{
"name": "VDB-406596 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406596/cti"
},
{
"name": "CVE-2026-93310 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93310"
},
{
"name": "Submit #942313 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942313"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-204"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93310",
"datePublished": "2026-09-18T00:00:12.701Z",
"dateReserved": "2026-09-17T17:05:53.808Z",
"dateUpdated": "2026-09-18T19:59:33.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93309 (GCVE-0-2026-93309)
Vulnerability from nvd – Published: 2026-09-17 23:30 – Updated: 2026-09-22 02:00
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 02:00 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406595 | vdb-entry |
| https://vuldb.com/vuln/406595/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93309 | third-party-advisory |
| https://vuldb.com/submit/942312 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-203 | related |
| https://gist.github.com/fklement/639eb04a12cc5c01… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93309",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T02:00:39.106673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T02:00:51.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:30:12.089Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406595 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406595"
},
{
"name": "VDB-406595 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406595/cti"
},
{
"name": "CVE-2026-93309 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93309"
},
{
"name": "Submit #942312 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942312"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-203"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93309",
"datePublished": "2026-09-17T23:30:12.089Z",
"dateReserved": "2026-09-17T17:05:48.359Z",
"dateUpdated": "2026-09-22T02:00:51.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93308 (GCVE-0-2026-93308)
Vulnerability from nvd – Published: 2026-09-17 23:15 – Updated: 2026-09-18 12:59
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 12:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406594 | vdb-entry |
| https://vuldb.com/vuln/406594/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93308 | third-party-advisory |
| https://vuldb.com/submit/942311 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-202 | related |
| https://gist.github.com/fklement/9f217219b95f7ced… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93308",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T12:59:04.605135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T12:59:16.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:15:13.993Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406594 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406594"
},
{
"name": "VDB-406594 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406594/cti"
},
{
"name": "CVE-2026-93308 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93308"
},
{
"name": "Submit #942311 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942311"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-202"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93308",
"datePublished": "2026-09-17T23:15:13.993Z",
"dateReserved": "2026-09-17T17:05:44.260Z",
"dateUpdated": "2026-09-18T12:59:16.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93307 (GCVE-0-2026-93307)
Vulnerability from nvd – Published: 2026-09-17 21:45 – Updated: 2026-09-23 17:53
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector memory allocation
Summary
A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 17:53 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406593 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/406593/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93307 | third-party-advisory |
| https://vuldb.com/submit/942297 | third-party-advisory |
| https://vuldb.com/submit/942306 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-201 | related |
| https://gist.github.com/fklement/1c1ff92588944a02… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93307",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T17:53:43.455806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:53:54.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/942297"
},
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/942306"
},
{
"tags": [
"exploit"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-201"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:45:10.125Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406593 | O-RAN-SC SMO OAM VES Collector memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/406593"
},
{
"name": "VDB-406593 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406593/cti"
},
{
"name": "CVE-2026-93307 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93307"
},
{
"name": "Submit #942297 | O-RAN-SC SMO/OAM L-Release CWE-789 Memory Allocation with Excessive Size Value",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942297"
},
{
"name": "Submit #942306 | O-RAN-SC SMO/OAM L-Release CWE-789 Memory Allocation with Excessive Size Value (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942306"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-201"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector memory allocation",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93307",
"datePublished": "2026-09-17T21:45:10.125Z",
"dateReserved": "2026-09-17T17:05:34.780Z",
"dateUpdated": "2026-09-23T17:53:54.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93310 (GCVE-0-2026-93310)
Vulnerability from cvelistv5 – Published: 2026-09-18 00:00 – Updated: 2026-09-18 19:59
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406596 | vdb-entry |
| https://vuldb.com/vuln/406596/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93310 | third-party-advisory |
| https://vuldb.com/submit/942313 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-204 | related |
| https://gist.github.com/fklement/f70321f38513c2e8… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93310",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:59:23.029478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:59:33.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T00:00:12.701Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406596 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406596"
},
{
"name": "VDB-406596 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406596/cti"
},
{
"name": "CVE-2026-93310 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93310"
},
{
"name": "Submit #942313 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942313"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-204"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93310",
"datePublished": "2026-09-18T00:00:12.701Z",
"dateReserved": "2026-09-17T17:05:53.808Z",
"dateUpdated": "2026-09-18T19:59:33.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93309 (GCVE-0-2026-93309)
Vulnerability from cvelistv5 – Published: 2026-09-17 23:30 – Updated: 2026-09-22 02:00
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 02:00 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406595 | vdb-entry |
| https://vuldb.com/vuln/406595/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93309 | third-party-advisory |
| https://vuldb.com/submit/942312 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-203 | related |
| https://gist.github.com/fklement/639eb04a12cc5c01… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93309",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T02:00:39.106673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T02:00:51.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:30:12.089Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406595 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406595"
},
{
"name": "VDB-406595 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406595/cti"
},
{
"name": "CVE-2026-93309 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93309"
},
{
"name": "Submit #942312 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942312"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-203"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93309",
"datePublished": "2026-09-17T23:30:12.089Z",
"dateReserved": "2026-09-17T17:05:48.359Z",
"dateUpdated": "2026-09-22T02:00:51.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93308 (GCVE-0-2026-93308)
Vulnerability from cvelistv5 – Published: 2026-09-17 23:15 – Updated: 2026-09-18 12:59
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector allocation of resources
Summary
A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 12:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406594 | vdb-entry |
| https://vuldb.com/vuln/406594/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93308 | third-party-advisory |
| https://vuldb.com/submit/942311 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-202 | related |
| https://gist.github.com/fklement/9f217219b95f7ced… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93308",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T12:59:04.605135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T12:59:16.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:15:13.993Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406594 | O-RAN-SC SMO OAM VES Collector allocation of resources",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/406594"
},
{
"name": "VDB-406594 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406594/cti"
},
{
"name": "CVE-2026-93308 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93308"
},
{
"name": "Submit #942311 | O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942311"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-202"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector allocation of resources",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93308",
"datePublished": "2026-09-17T23:15:13.993Z",
"dateReserved": "2026-09-17T17:05:44.260Z",
"dateUpdated": "2026-09-18T12:59:16.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93307 (GCVE-0-2026-93307)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:45 – Updated: 2026-09-23 17:53
VLAI
EPSS
VEX
Title
O-RAN-SC SMO OAM VES Collector memory allocation
Summary
A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 17:53 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/406593 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/406593/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93307 | third-party-advisory |
| https://vuldb.com/submit/942297 | third-party-advisory |
| https://vuldb.com/submit/942306 | third-party-advisory |
| https://lf-o-ran-sc.atlassian.net/browse/SMO-201 | related |
| https://gist.github.com/fklement/1c1ff92588944a02… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93307",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T17:53:43.455806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:53:54.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/942297"
},
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/942306"
},
{
"tags": [
"exploit"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-201"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:o-ran-sc:smo_oam:*:*:*:*:*:*:*:*"
],
"modules": [
"VES Collector"
],
"product": "SMO OAM",
"vendor": "O-RAN-SC",
"versions": [
{
"status": "affected",
"version": "2025-06-10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fklement (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:45:10.125Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-406593 | O-RAN-SC SMO OAM VES Collector memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/406593"
},
{
"name": "VDB-406593 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/406593/cti"
},
{
"name": "CVE-2026-93307 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93307"
},
{
"name": "Submit #942297 | O-RAN-SC SMO/OAM L-Release CWE-789 Memory Allocation with Excessive Size Value",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942297"
},
{
"name": "Submit #942306 | O-RAN-SC SMO/OAM L-Release CWE-789 Memory Allocation with Excessive Size Value (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/942306"
},
{
"tags": [
"related"
],
"url": "https://lf-o-ran-sc.atlassian.net/browse/SMO-201"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-17T19:11:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "O-RAN-SC SMO OAM VES Collector memory allocation",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93307",
"datePublished": "2026-09-17T21:45:10.125Z",
"dateReserved": "2026-09-17T17:05:34.780Z",
"dateUpdated": "2026-09-23T17:53:54.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}