Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of service

Published 20 mo ago 2025-03-04 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.8%

percentile 58%

Public exploits

none known

A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 20 mo ago 2025-03-04

Exploit prediction (EPSS)

0.83% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	6.9	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`
CNA	3.1	5.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
CNA	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`
CNA	4.0	6.9	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	5.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CNA	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

Affected products

n/a Open5GS

Classification

Weakness

CWE-404 Improper Resource Shutdown or Release

References

vuldb.com /?id.298513 · vdb-entry, technical-description, exploit
vuldb.com /?ctiid.298513 · signature, permissions-required
vuldb.com /?submit.506038 · third-party-advisory
github.com /guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20PDU%20Session% · exploit
github.com /open5gs/open5gs/pull/3711 · issue-tracking

Sources

CVE List: CVE-2025-1925
NVD: CVE-2025-1925

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary