Open5GS CVE-2026-8745

Requires authenticated access to Open5GS AUSF service interfaces (PR:L in CVSS vector). Specifically targets deployments where AUSF component processes authentication requests from network functions. Authentication typically means valid 5G network function credentials (service-based architecture tokens or IPsec associations), not end-user credentials. Exploitation is NOT possible from internet-connected UE (user equipment) devices directly - attacker must compromise or impersonate a trusted 5G core network function (AMF, UDM, NSSF, etc.) or leverage roaming partner credentials. Limits exploitation to scenarios with: (1) compromised adjacent network functions in the same 5G core deployment, (2) malicious or compromised roaming partners with peering agreements, or (3) insider access to network function credentials. Does not require specific AUSF configuration beyond standard deployment with timer functionality enabled (default). Open5GS versions must be ≤2.7.7.

CVSS 4.0 vector shows network-exploitable (AV:N) with low complexity (AC:L) but requires authentication (PR:L) and causes only low availability impact (VA:L) with Exploit Maturity as Proof-of-concept (E:P). The 2.1 score is unusually low, reflecting limited scope to availability only. However, real-world risk depends on deployment context: 5G core networks typically require authenticated network function credentials, limiting attack surface to compromised RAN components or malicious roaming partners. Public exploit code exists via GitHub issue #4472, lowering attacker barrier. Vendor non-responsiveness to early disclosure is concerning - no patch timeline confirmed. Not in CISA KEV, suggesting no widespread exploitation detected. EPSS score unavailable. Priority assessment: MEDIUM for production 5G core deployments with external connectivity; LOW for isolated lab environments. The authenticated requirement significantly reduces drive-by exploitation risk, but the public exploit and vendor silence warrant attention from operators running affected versions in multi-tenant or roaming scenarios.

An attacker with authenticated access to the 5G core network (such as a compromised AMF or UDM service, or credentials from a malicious roaming partner) sends specially crafted authentication requests to the Open5GS AUSF service. These requests trigger improper timer additions via the ogs_timer_add function in nausf-handler.c, causing resource leaks or null pointer crashes. Repeated exploitation exhausts AUSF resources or crashes the service, preventing legitimate subscriber authentication across the 5G network. Public exploit code available via GitHub issue #4472 provides attack blueprint.