CVE-2025-14954
📋 TL;DR
This vulnerability in Open5GS allows remote attackers to trigger reachable assertions in PFCP (Packet Forwarding Control Protocol) handling functions, potentially causing denial of service. Affected are Open5GS deployments up to version 2.7.6 that use the vulnerable PFCP component. The attack requires high complexity but could disrupt 5G core network functions.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote denial of service causing Open5GS to crash, disrupting 5G core network services for all connected users.
Likely Case
Service disruption requiring restart of affected Open5GS components, causing temporary connectivity loss.
If Mitigated
Minimal impact if proper network segmentation and monitoring are in place to detect and block malicious PFCP traffic.
🎯 Exploit Status
Exploit has been publicly disclosed and may be used, but requires specific PFCP protocol knowledge and manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit 442369dcd964f03d95429a6a01a57ed21f7779b7
Vendor Advisory: https://github.com/open5gs/open5gs/commit/442369dcd964f03d95429a6a01a57ed21f7779b7
Restart Required: Yes
Instructions:
1. Update Open5GS to version after 2.7.6 or apply commit 442369d. 2. Rebuild from source if using source installation. 3. Restart all Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict PFCP traffic to trusted sources only using firewall rules.
iptables -A INPUT -p udp --dport 8805 -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit PFCP traffic to authorized sources only.
- Deploy intrusion detection systems to monitor for abnormal PFCP traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version and verify if commit 442369d is present in the source code.Check Version:
open5gs --version || grep 'OPEN5GS_VERSION' in source filesVerify Fix Applied:
Verify Open5GS version is greater than 2.7.6 or that commit 442369d is applied in git history.📡 Detection & Monitoring
Log Indicators:
- Open5GS crash logs
- Assertion failure messages in PFCP handling
- Service restart patterns
Network Indicators:
- Malformed PFCP packets
- Unusual PFCP traffic from untrusted sources
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "pfcp")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/442369dcd964f03d95429a6a01a57ed21f7779b7
- https://github.com/open5gs/open5gs/issues/4181
- https://github.com/open5gs/open5gs/issues/4181#issue-3667069101
- https://github.com/open5gs/open5gs/issues/4181#issuecomment-3615646842
- https://vuldb.com/?ctiid.337590
- https://vuldb.com/?id.337590
- https://vuldb.com/?submit.716810
