CVE-2025-15419

low-risk
Published 2026-01-02

A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. Executing a manipulation can lead to denial of service. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5aaa09907e7b9e0a326265a5f08d56f54280b5f2. It is advisable to implement a patch to correct this issue.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Open5Gs

References (8)

https://github.com/open5gs/open5gs/
Patch https://github.com/open5gs/open5gs/commit/5aaa09907e7b9e0a326265a5f08d56f54280b5...
Exploit https://github.com/open5gs/open5gs/issues/4224
Exploit https://github.com/open5gs/open5gs/issues/4224#issue-3766767406
Exploit https://github.com/open5gs/open5gs/issues/4224#issuecomment-3698521008
Permissions Required https://vuldb.com/?ctiid.339341
Third Party Advisory https://vuldb.com/?id.339341
Third Party Advisory https://vuldb.com/?submit.728044
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal