Open5GS CVE-2025-15685

Q: What is the CVSS score of CVE-2025-15685?

CVE-2025-15685 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 38.0%.

EUVD-2025-210702 MEDIUM

Buffer Overflow (CWE-119)

2026-08-12 VulDB

GHSA-vxm6-3hjq-r228

Buffer Overflow Open5gs

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable Diameter interface with low-privilege requirement; no scope change; bounded CIA impact consistent with memory corruption without confirmed RCE.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 03:01 vuln.today

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory corruption. The attack is possible to be carried out remotely.

AnalysisAI

Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.

Technical ContextAI

Open5GS is an open-source implementation of both a 5G core network (5GC) and an Evolved Packet Core (EPC/4G), widely used in research, testing, and some production telecom environments. The affected component is freeDiameter, a third-party library implementing the Diameter protocol (RFC 6733/3588), which Open5GS uses for AAA (Authentication, Authorization, and Accounting) functions - specifically in nodes such as HSS, MME, and PCRF that communicate over the Diameter interface. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class, encompassing both classic buffer overflows and out-of-bounds read/write conditions. In a C-based networking library like freeDiameter, such flaws typically arise from insufficient length validation when parsing incoming AVP (Attribute-Value Pair) data in Diameter messages. The CPE identifier cpe:2.3:a:n/a:open5gs covers the Open5GS application suite; no CPE is separately assigned to the embedded freeDiameter dependency.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified in the available reference data at time of analysis; the GitHub issue at https://github.com/open5gs/open5gs/issues/4156 should be monitored for upstream commits or a tagged release addressing this flaw. Operators should upgrade Open5GS to any version released after 2.7.1 once a fix is confirmed via the official repository. As a compensating control, restrict network access to the Diameter interface (typically TCP/SCTP port 3868) using firewall rules or segment the 5G core network so that only authorized internal nodes (MME, PCF, HSS) can reach the freeDiameter listener - this does not eliminate the vulnerability but eliminates remote opportunistic access. Disabling unused Diameter interfaces or S6a/Gx/Gy reference points that are not required by the deployment can further reduce attack surface with the trade-off of reduced AAA functionality. Container or process isolation for Open5GS nodes can limit the blast radius of memory corruption exploitation.