CVE-2025-25774
📋 TL;DR
This vulnerability in Open5GS allows attackers to cause a denial of service by triggering a crash in the AMF component during specific handover scenarios. Attackers can disrupt 5G network services by exploiting an exception in the AMF's internal state machine. This affects organizations running vulnerable versions of Open5GS in their 5G core networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to loss of 5G connectivity for all users served by the affected AMF instance, potentially cascading to other network functions.
Likely Case
Temporary AMF crash requiring manual restart, causing service interruption for users during handover operations.
If Mitigated
Minimal impact with proper monitoring and automated recovery mechanisms in place.
🎯 Exploit Status
Exploitation requires specific timing during UE handover between gNBs, but detailed technical analysis is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 2e68706f1eea029d5172ccad946e78b352c031d0
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3671
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit 2e68706f1eea029d5172ccad946e78b352c031d0
2. Recompile and reinstall Open5GS
3. Restart AMF service
4. Verify fix with test handover scenarios
🔧 Temporary Workarounds
Rate limit handover requests
linuxImplement rate limiting on handover requests to reduce likelihood of triggering the timing condition
# Configure rate limiting in AMF configuration
# Example: Set max_handover_requests_per_second in amf.yaml
Disable handover functionality
linuxTemporarily disable handover between gNBs if not critically required
# Set handover_enabled: false in AMF configuration
🧯 If You Can't Patch
- Implement network segmentation to isolate AMF from untrusted traffic sources
- Deploy redundant AMF instances with load balancing to maintain service during crashes
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version and verify if commit 2e68706f1eea029d5172ccad946e78b352c031d0 is not appliedCheck Version:
open5gs-amfd --versionVerify Fix Applied:
Test handover scenarios between gNBs and monitor AMF stability, check that commit 2e68706f1eea029d5172ccad946e78b352c031d0 is present📡 Detection & Monitoring
Log Indicators:
- AMF crash logs
- Unexpected AMF process termination
- Handover request errors in AMF logs
- State machine exception messages
Network Indicators:
- Unusual handover request patterns
- Multiple failed handover attempts from same UE
- AMF service unavailability alerts
SIEM Query:
source="amf.log" AND ("crash" OR "exception" OR "handover error")