CVE-2025-15529
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS's SGWC component where remote attackers can manipulate the sgwc_s5c_handle_create_session_response function to crash the service. This affects all Open5GS deployments up to version 2.7.6 that have the SGWC component enabled and exposed to untrusted networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the SGWC component, potentially affecting 5G core network functionality for all connected devices.
Likely Case
Service crashes requiring manual restart, causing temporary service interruption for affected network functions.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
The exploit has been made public according to the CVE description, and remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit b19cf6a2dbf5d30811be4488bf059c865bd7d1d2
Vendor Advisory: https://github.com/open5gs/open5gs/commit/b19cf6a2dbf5d30811be4488bf059c865bd7d1d2
Restart Required: Yes
Instructions:
1. Update Open5GS to version after 2.7.6 or apply commit b19cf6a2dbf5d30811be4488bf059c865bd7d1d2. 2. Rebuild from source if using source installation. 3. Restart all Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to SGWC component to trusted sources only
iptables -A INPUT -p tcp --dport [SGWC_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [SGWC_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SGWC exposure
- Deploy monitoring and automated restart mechanisms for SGWC service
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version or examine source code for presence of vulnerable function in src/sgwc/s5c-handler.cCheck Version:
open5gs --version 2>&1 | head -1Verify Fix Applied:
Verify commit b19cf6a2dbf5d30811be4488bf059c865bd7d1d2 is applied: git log --oneline | grep b19cf6a2dbf5d30811be4488bf059c865bd7d1d2📡 Detection & Monitoring
Log Indicators:
- SGWC service crashes
- Segmentation fault errors in logs
- Unexpected termination of sgwc process
Network Indicators:
- Unusual traffic patterns to SGWC port
- Multiple connection attempts from single source
SIEM Query:
process.name="sgwc" AND (event.action="crashed" OR event.outcome="failure")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/b19cf6a2dbf5d30811be4488bf059c865bd7d1d2
- https://github.com/open5gs/open5gs/issues/4226
- https://github.com/open5gs/open5gs/issues/4226#issue-3769595366
- https://vuldb.com/?ctiid.341596
- https://vuldb.com/?id.341596
- https://vuldb.com/?submit.728130
- https://vuldb.com/?submit.738372
