CVE-2025-29646
📋 TL;DR
A vulnerability in open5gs upf component allows remote attackers to cause denial of service by sending specially crafted PFCP SessionEstablishmentRequest packets. This affects open5gs deployments using versions 2.7.2 and earlier. Attackers can crash the UPF service, disrupting 5G network functionality.
💻 Affected Systems
- open5gs
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete UPF service crash leading to loss of 5G data plane connectivity for all users in affected network segment
Likely Case
Service disruption affecting multiple users until UPF service is restarted
If Mitigated
Limited impact if network segmentation and rate limiting prevent malicious packets from reaching UPF
🎯 Exploit Status
Proof of concept available in GitHub issue; exploitation requires sending crafted PFCP packets to UPF
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.3 or later
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3747
Restart Required: Yes
Instructions:
1. Update open5gs to version 2.7.3 or later. 2. Restart UPF service. 3. Verify service is running correctly.
🔧 Temporary Workarounds
Network filtering
linuxBlock or filter PFCP SessionEstablishmentRequest packets with restoration indication = true and invalid TEID values
iptables -A INPUT -p udp --dport 8805 -m string --hex-string '|01 00 00 00|' --algo bm -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate UPF from untrusted networks
- Deploy rate limiting on PFCP interface to prevent rapid exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check open5gs version: open5gs-upfd --version. If version is 2.7.2 or earlier, system is vulnerable.Check Version:
open5gs-upfd --versionVerify Fix Applied:
After patching, verify version is 2.7.3 or later and UPF service remains stable under normal traffic📡 Detection & Monitoring
Log Indicators:
- UPF service crashes
- PFCP session establishment failures
- Error messages related to TEID validation
Network Indicators:
- PFCP packets with restoration indication = true and TEID = 0 or large TEID values
- Sudden increase in PFCP session requests
SIEM Query:
source="open5gs-upf.log" AND ("crash" OR "segmentation fault" OR "invalid TEID")