Is there a public PoC exploit available for CVE-2025-15176?

Yes, a public proof-of-concept exploit is available for CVE-2025-15176. Prioritise patching immediately. EPSS: 0.6%.

Is there a patch available for CVE-2025-15176?

Yes, a patch is available for CVE-2025-15176. Update the affected software to the latest version immediately.

Open5GS CVE-2025-15176

Q: What is the CVSS score of CVE-2025-15176?

CVE-2025-15176 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

MEDIUM

Reachable Assertion (CWE-617)

2025-12-29 cna@vuldb.com

Denial Of Service Open5gs

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated malformed-packet trigger (AV:N/AC:L/PR:N/UI:N) causing a process-aborting assertion, so availability-only impact A:H with C:N/I:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 18:43 vuln.today

CVE Published

Dec 29, 2025 - 07:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.

AnalysisAI

Denial of service in Open5GS through 2.7.5 allows an unauthenticated remote attacker to abort the affected process by delivering a malformed IPv6 packet that is evaluated by the PFCP Packet Detection Rule matching path, causing a reachable assertion failure (CWE-617). The flaw sits in decode_ipv6_header() and ogs_pfcp_pdr_rule_find_by_packet() in lib/pfcp/rule-match.c, which abort when an IPv6 header advertises a zero payload length (jumbo-payload indication) together with a non-zero NextHeader value - a combination the pre-patch code asserted was impossible. Impact is availability-only: the vendor scores it 5.5 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N/E:P/VC:N/VI:N/VA:L) and our independent assessment raises the availability impact to HIGH under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with publicly available exploit code exists but no confirmed actively exploited (CISA KEV) status and no data exposure or code execution demonstrated.

Technical ContextAI

Open5GS is an open-source 5G/4G core network implementation whose SMF/UPF components use PFCP (Packet Forwarding Control Protocol, 3GPP TS 29.244) to install Packet Detection Rules (PDRs) for user-plane traffic classification. When a packet arrives, ogs_pfcp_pdr_rule_find_by_packet() walks the packet against candidate rules and, for IPv6 traffic, calls decode_ipv6_header() to determine the next header and header length derived from the IPv6 payload-length field. The root cause is CWE-617 (Reachable Assertion): the code contained ogs_assert(nxt == 0) on the assumption that an IPv6 payload length of zero can only mean a jumbo-payload header (which mandates NextHeader=0), so an attacker-supplied header with payload length 0 and a non-zero NextHeader trips the assertion and terminates the process. The upstream fix (commit b72d8349980076e2c033c8324f07747a86eea4f8) replaces the assertion with an ogs_error() log and an OGS_ERROR return, and changes the caller in ogs_pfcp_pdr_rule_find_by_packet() to log a hexdump and 'continue' rather than abort, effectively dropping the malformed packet gracefully. The affected component is the PFCP Session Establishment Request handler, and the CPE cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:* applies to all builds up to and including 2.7.5.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit b72d8349980076e2c033c8324f07747a86eea4f8 (https://github.com/open5gs/open5gs/commit/b72d8349980076e2c033c8324f07747a86eea4f8), which converts the ogs_assert(nxt == 0) in decode_ipv6_header() into a logged OGS_ERROR return and makes ogs_pfcp_pdr_rule_find_by_packet() skip malformed IPv6 packets instead of aborting, and upgrade to a build that contains this change (anything newer than 2.7.5) as soon as one is available for your distribution. Where immediate patching is not possible, the highest-value compensating control is to stop untrusted IPv6 packets from reaching the PFCP/PDR matching path: enforce network segmentation so the N4/PFCP interface and user-plane ingress are reachable only from trusted core components, and block or rate-limit inbound IPv6 traffic on those paths at the perimeter. Operators who control the ingress can additionally filter IPv6 packets whose payload-length field is zero while the NextHeader field is non-zero, which is the exact malformed condition that triggers the abort; the trade-off is that legitimate jumbo-payload (hop-by-hop jumbo) traffic uses payload length 0 with NextHeader 0 and must be allowed through, and such filtering adds an extra DPI hop. Because the abort is a process-level crash, running the SMF/UPF under a supervisor that restarts the process reduces outage duration but does not prevent repeated denial of service, so it should be treated only as a stopgap. Monitoring for repeated process restarts or IPv6 parse errors in Open5GS logs provides a reasonable detection signal while the patch is rolled out.