CVE-2025-41067
📋 TL;DR
A reachable assertion vulnerability in Open5GS NRF (Network Repository Function) allows attackers with network connectivity to send a specific SBI request that deletes the NRF's own registry, causing the NRF process to crash. This results in denial of service, rendering the discovery service unavailable. Affected are Open5GS deployments up to version 2.7.6 where the NRF is exposed to untrusted networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of the NRF discovery service, disrupting 5G core network operations and preventing new devices from registering or discovering network functions.
Likely Case
Intermittent NRF service disruption requiring manual restart of the NRF process, causing temporary service degradation for 5G network functions.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized access to the NRF interface.
🎯 Exploit Status
The vulnerability requires sending a specific SBI request to delete the NRF's own registry, which triggers the assertion failure. No authentication is required beyond network access to the NRF interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.7.7 or later
Vendor Advisory: https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html
Restart Required: Yes
Instructions:
1. Download Open5GS version 2.7.7 or later from the official repository. 2. Stop all Open5GS services. 3. Install the updated version following the official installation guide. 4. Restart all Open5GS services. 5. Verify the NRF is running and responding to requests.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the NRF's SBI interface using firewall rules to only allow connections from trusted network functions.
iptables -A INPUT -p tcp --dport <NRF_PORT> -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport <NRF_PORT> -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the NRF from untrusted networks and systems.
- Deploy network monitoring and intrusion detection to alert on suspicious SBI requests targeting the NRF.
🔍 How to Verify
Check if Vulnerable:
Check the Open5GS version by examining the installed package or running the NRF binary with version flag. If version is 2.7.6 or earlier, the system is vulnerable.Check Version:
open5gs-nrfd --versionVerify Fix Applied:
After patching, verify the NRF service is running and test with legitimate SBI requests. Check that the version reported is 2.7.7 or later.📡 Detection & Monitoring
Log Indicators:
- NRF process crash logs
- Assertion failure messages in NRF logs
- Unexpected SBI DELETE requests targeting NRF's own registry
Network Indicators:
- SBI DELETE requests to NRF endpoint from unauthorized sources
- Sudden drop in NRF service availability
SIEM Query:
source="open5gs-nrf.log" AND ("assertion failed" OR "crash" OR "abort")