CVE-2025-25774

Published: Mar 12, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS).

Affected (1)

Products: Open5gs: Open5gs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Open5gs Open5gs	Version 2.7.2

Related CWEs

Insufficient Control Flow Management

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

References (3)

https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20GMM%20State%20Handling%20in%20Handover

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/open5gs/open5gs/commit/2e68706f1eea029d5172ccad946e78b352c031d0

Source: cve@mitre.org

Patch

https://github.com/open5gs/open5gs/issues/3671

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.