CVE-2025-15531
📋 TL;DR
This vulnerability in Open5GS allows remote attackers to trigger a reachable assertion in the sgwc_bearer_add function, potentially causing denial of service. It affects Open5GS deployments up to version 2.7.5. The issue has been fixed in later versions.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers could crash the SGWC service, causing denial of service for 5G core network functions
Likely Case
Service disruption affecting 5G bearer establishment and user connectivity
If Mitigated
Minimal impact if patched or workarounds applied
🎯 Exploit Status
Exploit is publicly available and attack can be carried out remotely
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.7.5
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4233
Restart Required: Yes
Instructions:
1. Update Open5GS to version after 2.7.5
2. Restart all Open5GS services
3. Verify the fix by checking version and monitoring logs
🔧 Temporary Workarounds
Network segmentation
linuxRestrict network access to SGWC service to trusted networks only
iptables -A INPUT -p tcp --dport <sgwc_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <sgwc_port> -j DROP
Service monitoring and restart
linuxImplement monitoring to detect and restart crashed SGWC service
systemctl enable open5gs-sgwc
systemctl start open5gs-sgwc
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version or check installed package versionCheck Version:
open5gs --version 2>&1 | grep -i versionVerify Fix Applied:
Verify version is greater than 2.7.5 and monitor logs for assertion failures📡 Detection & Monitoring
Log Indicators:
- Assertion failure messages in SGWC logs
- Service crash/restart events
- Unexpected termination of sgwc process
Network Indicators:
- Unusual traffic patterns to SGWC port
- Multiple connection attempts from single sources
SIEM Query:
process_name:"sgwc" AND (event_type:"crash" OR log_message:"assertion")