CVE-2025-15539
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS SGWC component where remote attackers can crash the service by sending malicious S11 protocol messages. This affects all Open5GS deployments up to version 2.7.6 that have SGWC enabled. The vulnerability is in the sgwc_s11_handle_downlink_data_notification_ack function.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the SGWC component, potentially affecting 5G core network functionality for affected subscribers.
Likely Case
Service interruption causing failed data sessions and connectivity issues for mobile users.
If Mitigated
Minimal impact with proper network segmentation and monitoring in place to detect and block exploitation attempts.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues and the vulnerability is in a network-facing component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit b4707272c1caf6a7d4dca905694ea55557a0545f
Vendor Advisory: https://github.com/open5gs/open5gs/commit/b4707272c1caf6a7d4dca905694ea55557a0545f
Restart Required: Yes
Instructions:
1. Update Open5GS to version after 2.7.6 or apply commit b4707272c1caf6a7d4dca905694ea55557a0545f. 2. Rebuild from source if using source installation. 3. Restart SGWC service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to S11 interface (default port 2123) to trusted networks only.
iptables -A INPUT -p tcp --dport 2123 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 2123 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S11 interface exposure
- Deploy intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version. If version is 2.7.6 or earlier, check if SGWC component is running.Check Version:
open5gs --versionVerify Fix Applied:
Verify the commit hash contains b4707272c1caf6a7d4dca905694ea55557a0545f or version is newer than 2.7.6.📡 Detection & Monitoring
Log Indicators:
- SGWC service crashes or restarts
- Error messages related to sgwc_s11_handle_downlink_data_notification_ack
- Unexpected S11 protocol errors
Network Indicators:
- Unusual S11 protocol traffic patterns
- Multiple malformed S11 messages from single source
SIEM Query:
source="open5gs.log" AND ("crash" OR "segmentation fault" OR "sgwc_s11")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/commit/b4707272c1caf6a7d4dca905694ea55557a0545f
- https://github.com/open5gs/open5gs/issues/4230
- https://github.com/open5gs/open5gs/issues/4230#issue-3774173079
- https://vuldb.com/?ctiid.341732
- https://vuldb.com/?id.341732
- https://vuldb.com/?submit.735339
