OMEC UPF CVE-2025-65566

The attacker must be able to deliver a PFCP Session Report Response message to the UPF's N4/PFCP endpoint (the SMF↔UPF 3GPP control interface) and the message must omit the mandatory Cause Information Element. No authentication is required (PR:N) and no user interaction is needed, and the flaw affects default handling in the vulnerable upf-epc-pfcpiface 2.1.3-dev build - there is no special feature or non-default configuration prerequisite. The primary limiting factor is reachability: N4/PFCP is normally deployed on a segmented, internal 5G core signaling network, so the practical precondition is attacker presence on or access to that control-plane network rather than internet exposure. Impact is limited to availability (process crash/user-plane disruption); no data compromise is possible.

This is a genuine availability risk but a context-dependent one, not a drop-everything priority. All signals point to the same technical reality: a reliable, low-complexity, unauthenticated nil-pointer crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) is internally consistent with the description - a single malformed PFCP Session Report Response reliably panics the process, so complexity is genuinely low and impact is pure availability (C:N/I:N). Public exploit material exists (the omec-project GitHub issue #958), which raises practical exploitability, but this is POC/disclosure detail - NOT active exploitation; the CVE is not in CISA KEV. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be stated. The single most important mitigating factor, which the network CVSS vector does NOT capture, is that the PFCP/N4 interface is a 3GPP control-plane interface between the SMF and UPF and is normally deployed on a segmented, non-internet-facing core network; AV:N is technically correct but real-world reachability typically requires an attacker already positioned on the 5G core signaling network. Net: a real DoS worth patching in affected deployments, but the AV:N score overstates exposure relative to typical N4 network segmentation - treat as medium-priority unless the N4 endpoint is reachable from untrusted networks.

An attacker with reachability to the UPF's N4/PFCP endpoint sends a crafted PFCP Session Report Response that omits the mandatory Cause Information Element. The session report handler dereferences a nil pointer instead of rejecting the malformed message, panicking and terminating the UPF process; repeating the message keeps the user-plane down. Public exploit/disclosure detail is available via omec-project GitHub issue #958, making reproduction straightforward.