EUVD-2026-80934
GHSA-h3cw-r349-w992
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PFCP has no authentication so PR:N; reachable ogs_assert aborts the whole SMF daemon giving A:H; no confidentiality or integrity impact; N4-internal exposure noted as a real-world limiter rather than a base-metric change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely. The identifier of the patch is e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9. It is suggested to install a patch to address this issue.
AnalysisAI
Malformed PFCP Session Report Request messages can abort the Open5GS SMF daemon, taking down all sessions handled by that SMF instance: in Open5GS through 2.8.0 the handler smf_n4_handle_session_report_request() signalled failure with a PFCP cause value that the caller in gsm-sm.c conflated with a session-release trigger, so a report with missing or inconsistent IEs drives execution into a reachable assertion (CWE-617) and terminates the process. The flaw is remotely triggerable by any host that can reach the SMF's N4/PFCP interface - normally the internal control-plane segment shared with the UPF - and because PFCP has no built-in authentication, no credentials are required once network reachability exists; the practical limiting factor is that N4 is not an internet-facing interface, not authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to send PFCP messages to the SMF's N4 interface - normally reachable only from within the mobile core (the UPF or a host on the control-plane network segment), as N4/PFCP is not an internet-facing interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority availability issue, not a high-real-risk crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9 (available at https://github.com/open5gs/open5gs/commit/e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9) or upgrade to any later Open5GS release that contains it; this is an upstream fix available as a commit/PR and a released patched version number is not independently confirmed in the provided data, so verify against the project's release notes before relying on a tagged build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today