Open5GS EUVD-2026-64676

The attacker must have low-privileged authenticated access to the network interfaces exposed by the Open5GS AMF - consistent with the CVSS PR:L rating - likely the N2 interface (from gNB) or the internal SBI (Service Based Interface) used for inter-NF communication. The flaw is specific to the UEContextReleaseRequest message processing path within the AMF component. Exploitation is limited by the requirement for at least low-level network access to the 5G core fabric; an external internet attacker without a foothold on the operator's core network cannot directly reach the AMF. No user interaction is required, and complexity is low once access is established. The attack is bounded to the vulnerable system scope - it does not propagate to other core network functions per the CVSS scope metrics.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N) with low confidentiality, integrity, and availability impact reflects a real but bounded risk: the attacker needs low-level privileges (PR:L), limiting opportunistic mass exploitation, yet the network attack vector and low complexity mean the barrier is not high once network access is established. The E:P supplemental metric confirms proof-of-concept code exists, which elevates urgency above a theoretical flaw. No EPSS score was provided in the input data. The vulnerability is not listed in the CISA KEV catalog, suggesting exploitation has not yet been observed at scale - however, 5G core network infrastructure is a high-value target for nation-state actors and telecom-focused threat groups, meaning even a mid-sized operator running an open-source 5G stack should treat this as a priority remediation item. The scope is limited to the vulnerable system (SC:N/SI:N/SA:N), suggesting no lateral scope change to other network functions, though unauthorized UE context release could disrupt active device sessions and degrade service availability.

An attacker with low-privileged access to the 5G core network's internal interfaces - for example, a compromised network function or a rogue node injected onto the Service Based Architecture network - sends a crafted UEContextReleaseRequest message to the Open5GS AMF targeting an active UE session. The AMF's handler fails to verify the requestor's authorization, accepts the malicious request, and releases the targeted UE's context, forcibly disconnecting the device and potentially exposing session metadata. A proof-of-concept exists, suggesting this flow has been demonstrated by the reporter.