OMEC UPF CVE-2025-65565

Exploitation requires (1) network reachability to the UPF's N4/PFCP control-plane endpoint and (2) a previously established PFCP association, after which a single Session Establishment Request lacking the mandatory F-SEID (CPF-SEID) IE triggers the crash. Limiting factors: the N4 interface is an internal 5G core interface typically segmented away from untrusted networks and normally spoken only by the SMF, so practical exploitation presumes an attacker already positioned inside the core network segment or able to impersonate/compromise an SMF; the flaw affects only the specific build upf-epc-pfcpiface:2.1.3-dev of the omec-project UPF. Impact is limited to availability - no data disclosure or modification.

This is a genuine but context-bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) reports a network-reachable, low-complexity, unauthenticated attack with high availability impact and no confidentiality/integrity impact - consistent with the described null-pointer-dereference crash (CWE-476). Public exploit information exists (the omec-project GitHub issue #957 referenced by NVD), which lowers the barrier to reproduction, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - treat this as publicly reproducible, not weaponized. The most important nuance the raw CVSS score hides: the PFCP/N4 endpoint is an internal 5G core control-plane interface normally reachable only from the SMF (or an attacker already inside the core network segment), and the description states a PFCP association must already be established, so PR:N overstates real-world exposure for properly segmented deployments. Net priority: medium - a reliable, repeatable crash of a core-network function is operationally serious, but reachability of the N4 interface is the true gating factor, not raw CVSS.

An attacker with network reachability to the UPF's N4/PFCP endpoint (e.g. a compromised host inside the 5G core segment or a rogue/compromised SMF) first establishes a PFCP association, then sends a PFCP Session Establishment Request deliberately omitting the mandatory F-SEID (CPF-SEID) IE. The handler calls IE.FSEID() on a nil pointer, panicking and terminating the UPF process; repeating the request keeps the user-plane down. Public reproduction detail is available via the referenced GitHub issue, so no original exploit development is required.