Is there a public PoC exploit available for CVE-2025-15686?

Yes, a public proof-of-concept exploit is available for CVE-2025-15686. Prioritise patching immediately. EPSS: 51.0%.

Open5GS CVE-2025-15686

Q: What is the CVSS score of CVE-2025-15686?

CVE-2025-15686 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 51.0%.

EUVD-2025-210703 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-08-12 VulDB

GHSA-hwwm-2gq7-f4rr

Denial Of Service Open5gs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable Diameter interface requires low-privilege access; impact is strictly limited to HSS availability with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 12, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Aug 12, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 12, 2026 - 03:03 vuln.today

CVE Published

Aug 12, 2026 - 02:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation of the argument Session-Id leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project locked and limited conversation to collaborators.

AnalysisAI

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.

Technical ContextAI

Open5GS is an open-source implementation of the 3GPP 4G EPC and 5G core network, commonly used for private cellular deployments, research, and MVNO/operator testing. The HSS (Home Subscriber Server) is the central subscriber database responsible for authentication and authorization of mobile subscribers using the Diameter protocol (RFC 6733). The function fd_msg_sess_get is responsible for resolving session objects from Diameter messages using their Session-Id AVP (Attribute-Value Pair). CWE-404 (Improper Resource Shutdown or Release) identifies the root cause: when a malformed or unexpected Session-Id is provided - as demonstrated via a crafted ULR (Update-Location-Request) message - the function fails to properly release or handle the associated resource, resulting in a service crash or hang. The CPE string cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* covers all affected versions. The affected Diameter interface is an internal core-network service, typically listening on TCP/SCTP port 3868.

RemediationAI

No vendor-released patch version has been independently confirmed from the available input data; the upstream GitHub project conversation has been locked and limited to collaborators, suggesting active remediation work is underway. Operators should monitor the Open5GS GitHub repository (https://github.com/open5gs/open5gs/) and issue #4190 (https://github.com/open5gs/open5gs/issues/4190) for a patched release and upgrade immediately upon availability. As compensating controls until a patch is available: restrict network access to the HSS Diameter interface (typically TCP/SCTP 3868) exclusively to trusted core network elements such as the MME, PCRF, and S-GW using firewall ACLs or network segmentation - this eliminates access from untrusted endpoints but does not protect against a compromised internal node. Implement Diameter message-level filtering or a Diameter Edge Agent (DEA) to validate Session-Id AVP format and length before forwarding to the HSS; this adds latency and a new point of failure but narrows the exploitable attack surface. Enable process supervision via systemd (RestartSec, Restart=on-failure) to automatically restart the HSS after a crash, minimizing service downtime, though this does not prevent exploitation. Avoid exposing the Diameter interface to untrusted or external networks under any circumstances.