Open5GS CVE-2026-8728

Exploitation requires authenticated access as a 5G network function with low-level privileges (PR:L) - specifically, valid credentials to send Service-Based Interface requests to the Network Repository Function. The attacker must be able to reach the NRF component over the network (AV:N) and construct SBI discovery requests per 3GPP TS 29.510 specifications. The vulnerability affects the NRF component specifically when processing NF Discovery requests containing target-plmn-list parameters, which is a standard service discovery feature enabled by default in Open5GS deployments. No special configuration required beyond standard Open5GS NRF deployment. Exploitation is limited by the need for 5G network function credentials, making this an insider threat or post-compromise pivot scenario rather than mass-internet exploitation. User interaction not required (UI:N). Works against default Open5GS configurations up to version 2.7.7.

Real-world risk is moderate despite the low CVSS 4.3 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation with low complexity but requires low-privilege authentication - likely a valid 5G network function credential. This limits mass-internet exploitation but enables insider threats or compromised NF instances within 5G deployments. The E:P (Proof-of-Concept Exists) modifier confirms weaponizable code availability via GitHub issue #4458. The RL:X (Response Level Unavailable) modifier is critical: vendor non-responsiveness means no patch timeline exists, prolonging exposure. For production 5G core networks, NRF unavailability disrupts service discovery for all network functions, cascading to complete 5G service outage - a high-impact scenario despite the CVSS Availability:Low rating which only reflects process-level impact. The attack is not automatable at scale (requires 5G network context and credentials) but trivial for authenticated attackers within telecom environments. No EPSS or KEV data provided - unable to assess wild exploitation patterns, but telecom-targeted attacks are typically lower-volume and higher-sophistication. Priority depends on asset criticality: high for production 5G deployments, low for lab/test environments.

An attacker with low-privilege credentials to a 5G network function (e.g., compromised AMF or SMF service account) crafts a malicious NF Discovery request to the NRF component. The request includes a malformed target-plmn-list parameter specifically designed to trigger the parsing flaw in ogs_sbi_discovery_option_parse_plmn_list. Upon processing, the NRF crashes due to improper resource handling (CWE-404), causing service discovery failure across the entire 5G core network. All network functions lose ability to locate peer services, resulting in complete 5G service outage until manual NRF restart. Publicly available exploit code in GitHub issue #4458 provides attack implementation details.