CVE-2025-15528

low-risk
Published 2026-01-16

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 98f76e98df35cd6a35e868aa62715db7f8141ac1. A patch should be applied to remediate this issue.

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Open5Gs

References (10)

https://github.com/open5gs/open5gs/
Patch https://github.com/open5gs/open5gs/commit/98f76e98df35cd6a35e868aa62715db7f8141a...
Exploit https://github.com/open5gs/open5gs/issues/4225
Exploit https://github.com/open5gs/open5gs/issues/4225#issue-3769531006
Permissions Required https://vuldb.com/?ctiid.341595
Third Party Advisory https://vuldb.com/?id.341595
Third Party Advisory https://vuldb.com/?submit.728128
https://vuldb.com/?submit.729359
https://vuldb.com/?submit.729360
https://vuldb.com/?submit.738373
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal