OMEC UPF CVE-2025-65568
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach UPF N4/PFCP endpoint
-
DeliveryEstablish PFCP association
-
ExploitSend Session Establishment Request with malformed CreateFAR
-
ExecutionTruncated IPv4 field triggers out-of-bounds read in ip2int()
-
PersistUPF process panics and crashes
-
ImpactRepeat to sustain user-plane outage
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the UPF's N4/PFCP endpoint (UDP/8805) and completion of a prior PFCP association, after which a single crafted PFCP Session Establishment Request carrying a CreateFAR IE with an empty or truncated IPv4 address field triggers the panic. The CVSS vector is PR:N/UI:N, so no authentication or user interaction is required by the protocol itself. The primary limiting factor is that N4 is an internal 3GPP core interface - in a segmented deployment only the SMF can reach it, so exploitation presupposes either a flat/exposed network, a compromised or spoofable core element, or a misconfigured UPF. Confirmed affected configuration is limited to the 2.1.3-dev build. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity, unauthenticated crash with availability-only impact - no confidentiality or integrity loss despite the input tags labeling it 'Information Disclosure', which appears inaccurate for a panic-based DoS. EPSS is low at 0.46% (37th percentile) and the CVE is not in CISA KEV, indicating no evidence of widespread active exploitation. However, publicly available exploit material exists (upstream issue #962), lowering the practical barrier. The dominant limiting factor is exposure of the N4/PFCP endpoint: PFCP is an internal core-network interface normally isolated from untrusted networks, so real-world risk depends heavily on whether N4 is segmented - the AV:N rating assumes reachability that a properly segmented mobile core would not grant. Net: a genuine availability threat to exposed or flat-network OMEC deployments, but the small footprint and internal-interface nature make it targeted rather than mass-exploitable. |
| Exploit ScenarioDerived | An attacker with a path to the UPF's N4/PFCP endpoint completes a PFCP association, then sends a PFCP Session Establishment Request containing a CreateFAR whose IPv4 address field is empty or truncated. parseFAR() reads past the buffer and the UPF process panics; repeating the request keeps the user-plane function down, disrupting subscriber traffic. Public exploit detail is referenced in upstream issue #962, and the low-complexity, no-authentication vector (AC:L/PR:N) makes the crash trivially repeatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Remote denial-of-service in the omec-project UPF (pfcpiface component, version upf-epc-pfcpiface 2.1.3-dev) lets any endpoint able to reach the N4/PFCP interface crash the user-plane function by sending a malformed PFCP Session Establishment Request. The request carries a CreateFAR IE with an empty or truncated IPv4 address; parseFAR() passes it to ip2int(), which reads past the buffer and triggers a Go index-out-of-range panic (CWE-125). Publicly available exploit references exist via the upstream issue tracker, though EPSS remains low (0.46%) and it is not on CISA KEV.
RemediationAI
No vendor-released patched version is identified at time of analysis - the only fix reference is the upstream issue https://github.com/omec-project/upf/issues/962, so monitor that issue and the omec-project/upf repository for a tagged release and upgrade once available. As compensating controls, restrict N4/PFCP reachability by network segmentation and firewalling the UPF's PFCP port (UDP 8805) so only the trusted SMF can send Session Establishment Requests - this is the highest-value mitigation with essentially no functional trade-off in a correctly designed core. Enforce PFCP peer allow-listing at the UPF so associations are only accepted from known SMF addresses (trade-off: requires accurate SMF inventory). If source modification is feasible, add input-length validation in parseFAR()/ip2int() to reject FARs whose IPv4 field is not four bytes and recover from the panic rather than crashing the process.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is pfcpiface, the Go control-plane agent for the OMEC (Open Mobile Evolved Core) UPF, a 4G/5G user-plane function developed under Open Networking Foundation and identified by CPE cpe:2.3:a:opennetworking:upf:2.1.3:dev. PFCP (Packet Forwarding Control Protocol, 3GPP TS 29.244) runs on the N4 interface and lets the SMF program forwarding rules - including FARs (Forwarding Action Rules) - into the UPF. The root cause is CWE-125 out-of-bounds read: parseFAR() invokes ip2int() on the FAR's IPv4 address field without validating that the buffer contains the expected four bytes, so an empty or truncated field causes a slice index beyond bounds and an unrecovered panic that terminates the process.
Know when Upf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
PFCP N4 endpoint is network-reachable with no protocol authentication (AV:N/PR:N), a single malformed request reliably crashes the process (AC:L), and impact is availability-only (C:N/I:N/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
Executive ViewAI
The omec-project UPF (User Plane Function), a critical 5G mobile network component used in production mobile infrastructure, is vulnerable to remote denial-of-service attacks in version 2.1.3-dev. Network endpoints with access to the PFCP interface can crash the service by submitting malformed requests, disrupting mobile network operations. While publicly available exploit code exists, current active exploitation remains minimal (0.5% EPSS), but organizations must urgently secure or isolate affected deployments.
Restrict PFCP (N4) interface network access to authorized control-plane nodes via firewall rules and network segmentation. Disable external routing to PFCP ports if operationally feasible. Deploy redundant UPF instances to absorb availability impact of individual node compromise. No vendor-released patch identified at time of analysis; establish continuous monitoring of upstream omec-project repository for security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Malformed PFCP Session Report Response messages delivered to the OMEC UPF's N4 endpoint cause the pfcpiface session-repo
Denial of service in the OMEC project UPF pfcpiface build upf-epc-pfcpiface:2.1.3-dev: once a PFCP association is establ
Denial of service in the omec-project UPF's pfcpiface component (build 2.1.3-dev) allows remote attackers to crash the U
Remote unauthenticated attackers can crash the OMEC UPF 2.1.3-dev process by sending a PFCP Association Setup Request th
Malformed PFCP Association Setup Request messages crash the OMEC UPF (upf-epc/pfcpiface) by dereferencing a nil NodeID p
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service v
Exploit-DB