EUVD-2025-210704
GHSA-cfh6-r6wv-jf9h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack via Diameter Gx requires low-privilege peer access; SMF process crash completely halts 5G session management, warranting A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised.
AnalysisAI
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Technical ContextAI
Open5GS is an open-source implementation of the 3GPP 5G/4G core network stack. The SMF (Session Management Function) implements the Diameter Gx interface to communicate with the PCRF (Policy and Charging Rules Function) for policy enforcement. The vulnerable smf_gx_cca_cb callback processes Credit-Control-Answer (CCA) messages received from the PCRF. The root cause maps to CWE-404 (Improper Resource Shutdown or Release): the codebase relied on ogs_assert() macros for null-pointer validation and return-code checks throughout the Diameter message handler. When a malformed or crafted CCA triggers an assertion condition - such as a missing AVP or a failed message operation returning non-zero - the process aborts via the assertion mechanism rather than handling the error gracefully and continuing. The patch (commit f23d7a5e959acd8f37b925dc29b85f26b7d391cb, PR #4034) replaces assert-on-failure patterns with explicit if-error-goto-out error paths, proper null-pointer checks, and structured cleanup. CPE cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* covers all Open5GS versions through 2.7.6.
RemediationAI
Upgrade Open5GS to version 2.7.7 or later, which incorporates the fix introduced in commit f23d7a5e959acd8f37b925dc29b85f26b7d391cb (pull request #4034 at https://github.com/open5gs/open5gs/pull/4034; release tag at https://github.com/open5gs/open5gs/releases/tag/v2.7.7). If an immediate upgrade is not operationally feasible, restrict network access to the Diameter Gx interface (typically TCP port 3868) using firewall ACLs or network segmentation to permit only explicitly trusted PCRF IP addresses - this limits exploitation to compromised nodes already within the trusted Diameter signaling domain, reducing but not eliminating risk. Additionally, configure process supervision (e.g., systemd restart policies) for the SMF so that a crash-induced outage recovers automatically; note that this mitigates availability impact but does not prevent the crash itself and may mask repeated exploitation attempts.
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today