Analysis of multiple vulnerabilities in different open source BTS products

This report discloses multiple remote vulnerabilities in widely used GSM/UMTS BTS transceiver code: sockets are bound to INADDR_ANY allowing external access, the control channel contains a stack-based buffer overflow enabling potential remote code execution or DoS, and the control protocol is unauthenticated allowing remote operational control (power, tuning, identity). Affected products include OpenBTS, YateBTS, OpenBTS-UMTS, and Osmo-TRX; the report provides technical details, proof-of-concept behavior, a disclosure timeline (including some reverted fixes), and mitigation recommendations such as binding to localhost, firewalling ports, compile-time hardening, fixing buffer handling, and adding authentication.