Skip to main content

Open5GS EUVDEUVD-2026-64722

| CVE-2026-78186 LOW
Reachable Assertion (CWE-617)
2026-08-24 VulDB GHSA-x497-rqwr-7qm2
Denial Of Service Open5gs
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Diameter Cx peering credentials required (PR:L); crash causes restartable DoS only with no data exposure or integrity impact (C:N/I:N/A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Severity Changed
Aug 24, 2026 - 05:22 NVD
MEDIUM LOW
CVSS changed
Aug 24, 2026 - 05:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Source Code Evidence Fetched
Aug 24, 2026 - 05:01 vuln.today
Analysis Generated
Aug 24, 2026 - 05:01 vuln.today
CVE Published
Aug 24, 2026 - 04:15 cve.org
MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4. It is recommended to apply a patch to fix this issue.

AnalysisAI

Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Establish Diameter Cx peer access
Delivery
Craft UAR/MAR/SAR/LIR request with empty User-Name AVP
Exploit
Send request to Open5GS HSS
Execution
Unguarded assertion fires in hss-cx-path.c
Persist
HSS process terminates
Impact
IMS authentication denied for all subscribers
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege Diameter Cx interface access - the attacker must be a Diameter peer configured within the Open5GS HSS realm, or must control a legitimate IMS network node (such as a P-CSCF, I-CSCF, or S-CSCF) capable of sending Diameter Cx requests. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) characterizes this as a remotely exploitable, low-complexity denial-of-service with low-privilege access required and limited availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker controlling a rogue Diameter peer - or having compromised a legitimate IMS component such as a P-CSCF or I-CSCF - sends a Diameter UAR message to the Open5GS HSS with a User-Name AVP set to an empty string. The HSS callback in hss-cx-path.c passes the empty value to internal processing without validation, triggering a reachable assertion that terminates the HSS process. …
Remediation Apply the upstream fix by cherry-picking or integrating commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 from the Open5GS GitHub repository (https://github.com/open5gs/open5gs/commit/c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open5gs

View all
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2024-40130 CRITICAL POC
9.8 Jul 16

open5gs v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2024-40129 CRITICAL POC
9.8 Jul 16

Open5GS v2.6.4 is vulnerable to Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2021-28122 CRITICAL POC
9.8 Mar 10

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. Rated critical severity (CVSS 9.8
CVE-2025-15685 MEDIUM
5.3 Aug 12

Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, all
CVE-2021-25863 HIGH POC
8.8 Jan 26

Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Rated high severity (CVS
CVE-2023-37023 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. Rated high sev
CVE-2023-37021 HIGH POC
8.6 Jan 22

Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the

CVE-2023-37020 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the

CVE-2023-37019 HIGH POC
8.6 Jan 22

Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-64722 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy