CVE-2025-14955
📋 TL;DR
This vulnerability in Open5GS PFCP handler allows remote attackers to exploit improper initialization in the ogs_pfcp_handle_create_pdr function. It affects Open5GS deployments up to version 2.7.5, potentially leading to service disruption or unauthorized access. The attack requires high complexity but has a public exploit available.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise or persistent denial of service affecting 5G core network functions.
Likely Case
Service disruption, crashes, or memory corruption affecting PFCP session management functionality.
If Mitigated
Limited impact due to network segmentation and proper access controls preventing exploitation attempts.
🎯 Exploit Status
Exploit has been made public according to CVE description. Attack requires understanding of PFCP protocol and Open5GS implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 773117aa5472af26fc9f80e608d3386504c3bdb7 and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4182
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit 773117aa5472af26fc9f80e608d3386504c3bdb7
2. Recompile Open5GS from source
3. Restart all Open5GS services
4. Verify PFCP functionality is operational
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict PFCP traffic to trusted sources only using firewall rules
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
Service Monitoring
linuxImplement aggressive monitoring and automatic restart for Open5GS PFCP service
systemctl enable open5gs-pfcpd
systemctl start open5gs-pfcpd
🧯 If You Can't Patch
- Implement strict network access controls to limit PFCP traffic to authorized sources only
- Deploy intrusion detection systems monitoring for abnormal PFCP protocol patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version should show 2.7.5 or earlier. Verify PFCP handler.c contains vulnerable code.Check Version:
open5gs --versionVerify Fix Applied:
Verify commit 773117aa5472af26fc9f80e608d3386504c3bdb7 is present in git log. Test PFCP session creation functionality.📡 Detection & Monitoring
Log Indicators:
- PFCP handler crashes
- Memory corruption errors in Open5GS logs
- Abnormal PFCP Create PDR requests
Network Indicators:
- Malformed PFCP packets on port 8805/UDP
- Unusual PFCP session creation patterns
SIEM Query:
source="open5gs.log" AND ("segmentation fault" OR "memory corruption" OR "PFCP handler")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/773117aa5472af26fc9f80e608d3386504c3bdb7
- https://github.com/open5gs/open5gs/issues/4182
- https://github.com/open5gs/open5gs/issues/4182#issue-3670797098
- https://github.com/open5gs/open5gs/issues/4182#issuecomment-3616081878
- https://vuldb.com/?ctiid.337591
- https://vuldb.com/?id.337591
- https://vuldb.com/?submit.716841
- https://github.com/open5gs/open5gs/issues/4182
- https://github.com/open5gs/open5gs/issues/4182#issue-3670797098
- https://github.com/open5gs/open5gs/issues/4182#issuecomment-3616081878
