CVE-2025-14953
📋 TL;DR
A null pointer dereference vulnerability in Open5GS's PFCP handler allows remote attackers to cause denial of service by crashing the service. This affects Open5GS deployments up to version 2.7.5 that handle PFCP protocol traffic. The vulnerability is in the FAR-ID handler component and requires specific network manipulation to exploit.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker causes service disruption through denial of service, potentially affecting 5G network functionality for connected devices.
Likely Case
Service crash requiring restart, causing temporary service interruption for affected network functions.
If Mitigated
Minimal impact with proper network segmentation and monitoring; service automatically restarts with minimal downtime.
🎯 Exploit Status
Exploit requires specific PFCP protocol manipulation; published exploit details exist but require technical expertise to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 93a9fd98a8baa94289be3b982028201de4534e32 and later
Vendor Advisory: https://github.com/open5gs/open5gs/commit/93a9fd98a8baa94289be3b982028201de4534e32
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply specific commit 2. Rebuild from source if using custom build 3. Restart Open5GS services
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict PFCP protocol access to trusted network segments only
iptables -A INPUT -p udp --dport 8805 -s trusted_network -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls for PFCP port 8805/UDP
- Deploy monitoring and automatic restart mechanisms for Open5GS services
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version or examine source code for commit hashCheck Version:
open5gs --version 2>&1 | grep -i versionVerify Fix Applied:
Verify commit 93a9fd98a8baa94289be3b982028201de4534e32 is present in source or version is newer than 2.7.5📡 Detection & Monitoring
Log Indicators:
- Segmentation fault in Open5GS logs
- Service crash/restart events
- PFCP handler error messages
Network Indicators:
- Unusual PFCP protocol traffic patterns
- Multiple connection attempts to port 8805/UDP
SIEM Query:
source="open5gs.log" AND ("segmentation fault" OR "null pointer" OR "crash")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/93a9fd98a8baa94289be3b982028201de4534e32
- https://github.com/open5gs/open5gs/issues/4179
- https://github.com/open5gs/open5gs/issues/4179#issue-3666399406
- https://github.com/open5gs/open5gs/issues/4179#issuecomment-3614868758
- https://vuldb.com/?ctiid.337589
- https://vuldb.com/?id.337589
- https://vuldb.com/?submit.716799
