The vulnerability in OpenAirInterface v2.2.0 involves acceptance of Security Mode Complete messages without integrity protection when a user equipment (UE) sends an initial registration request with only the IA0 security capability, despite the configuration supporting integrity algorithms NIA1 and NIA2. This results in a downgrade of the security context, which can lead to replay attacks. The issue relates to improper authentication controls (CWE-294). No patch or official remediation level has been provided as of the published date.

The vulnerability allows an attacker to potentially replay messages by exploiting the acceptance of unprotected Security Mode Complete messages, leading to a compromise of the integrity of the authentication process. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or official remediation instructions are currently provided.