EUVD-2025-210701
GHSA-c5w8-855p-98pc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, no complexity barrier; impact is process crash only, so A:L and C/I:N with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.7.7 is able to address this issue. The patch is identified as c1a803516a3c0485696cb9bcca7a80ad857c7383. It is advisable to upgrade the affected component.
AnalysisAI
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
Technical ContextAI
Open5GS is an open-source implementation of 4G/5G core network functions. The affected component is the Diameter protocol library (lib/diameter/common/init.c), which handles Capabilities Exchange Requests (CER) - the handshake messages used between Diameter peers to negotiate protocol capabilities. The root cause is CWE-617 (Reachable Assertion): the function diam_log_func contained a call to ogs_assert_if_reached(), a macro that unconditionally aborts the process when executed. A crafted or malformed CER message could drive the handler into a code path that triggers this assertion, aborting the process. The commit c1a803516a3c0485696cb9bcca7a80ad857c7383 fixes this by removing the assert call. Affected CPE: cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* up to 2.7.6.
RemediationAI
Upgrade Open5GS to version 2.7.7 or later, which includes the fix in commit c1a803516a3c0485696cb9bcca7a80ad857c7383 (https://github.com/open5gs/open5gs/commit/c1a803516a3c0485696cb9bcca7a80ad857c7383). The release is available at https://github.com/open5gs/open5gs/releases/tag/v2.7.7. If immediate upgrade is not possible, restrict access to the Diameter CER endpoint at the network level using firewall rules or IPsec transport-layer filtering to allow only known, trusted Diameter peers - this reduces the attack surface to authenticated or whitelisted peers only, at the cost of blocking new peer discovery. Do not expose the Diameter port (3868 TCP/SCTP) to untrusted networks.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today