OMEC UPF CVE-2025-65563

Exploitation requires network reachability to the UPF's N4/PFCP interface (PFCP over UDP 8805) and the ability to send a PFCP Association Setup Request with the mandatory NodeID IE omitted - no authentication, credentials, or user interaction are needed (PR:N/UI:N), and it works against default handling in affected versions up to at least upf-epc-pfcpiface:2.1.3-dev. The primary limiting factor is exposure: the N4 interface is intended to sit on a protected internal 5G-core network between SMF and UPF, so an attacker must first gain access to that control-plane segment; proper network segmentation and PFCP peer/source filtering are the main mitigations until the PR #963 fix is deployed.

All signals align on a credible, moderate-to-high operational risk for affected 5G deployments, though impact is confined to availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remote, unauthenticated, low-complexity attack with no user interaction and pure availability impact (CWE-476, nil pointer dereference). This is consistent with the description: a single malformed PFCP Association Setup Request omitting the mandatory NodeID IE crashes the UPF process, and it can be repeated to sustain an outage. Publicly available exploit code exists (referenced GitHub issue #955 and the fixing PR #963, which confirms the root cause and remediation). There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active mass exploitation - the appropriate reading is that exploitation is technically trivial and demonstrated but not confirmed in the wild. No SSVC decision data was supplied. The one material caveat is exposure: real risk hinges entirely on whether the N4/PFCP endpoint is reachable by the attacker; in a correctly segmented 5G core this interface should be on a protected internal network, which materially lowers real-world risk below what the AV:N score alone implies. Net: a genuine priority for anyone running the affected omec-project UPF with a reachable N4 interface, but not a general-internet emergency given the deployment context and absence of KEV/EPSS escalation signals.

An attacker with network reachability to the UPF's N4/PFCP endpoint (UDP port 8805) sends a single crafted PFCP Association Setup Request that omits the mandatory NodeID Information Element. The association setup handler dereferences a nil pointer and panics, terminating the UPF process and dropping user-plane traffic; the attacker simply resends the packet to keep the UPF crashed. Public exploit/PoC detail is available via the project's GitHub issue, making reproduction straightforward.