OMEC UPF CVE-2025-65564

Exploitation requires network reachability to the UPF's N4/PFCP (Packet Forwarding Control Protocol) endpoint and the ability to send a PFCP Association Setup Request whose mandatory Recovery Time Stamp IE is absent; PFCP has no application-layer authentication, so no credentials are needed (consistent with PR:N). The concrete trigger is the missing Recovery Time Stamp IE causing a nil dereference in handleAssociationSetupRequest. The primary limiting factor is deployment topology: the N4 interface is an internal 5G control-plane link between SMF and UPF and is normally isolated from untrusted networks, so realistic exposure depends on whether that segment is reachable by an attacker. Affects omec-project upf at version 2.1.3-dev; impact is a repeatable process crash (availability only).

The signals are largely consistent and point to a genuine but bounded availability risk. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a remote, unauthenticated, low-complexity attack with no user interaction and pure availability impact - no confidentiality or integrity loss. A public proof-of-concept exists (GitHub issue omec-project/upf#956 is flagged as an exploit reference), which raises practical exploitability, and the fix is confirmed by PR #964, whose diff shows the exact missing nil-check on RecoveryTimeStamp. The vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - exploitation status is limited to the existence of public exploit detail, which is distinct from in-the-wild use. The one factor that tempers the AV:N rating is that the PFCP/N4 interface is an internal 5G control-plane interface normally segmented from untrusted networks; the CVSS treats it as network-reachable, which is accurate on the wire, but realistic exposure depends on network isolation. Net: a real priority for operators running this specific open-source UPF with reachable N4, but the limited product footprint and availability-only impact keep it below the tier of a widely-exploited critical flaw.

An attacker with network reachability to the UPF's N4/PFCP endpoint sends a single crafted PFCP Association Setup Request that omits the mandatory Recovery Time Stamp Information Element. The handler calls IE.RecoveryTimeStamp() on the absent IE, dereferences a nil pointer, and panics, terminating the UPF process; repeating the request keeps the user-plane function down. A public proof-of-concept describing this condition exists (omec-project/upf issue #956).