CVE-2025-52322
📋 TL;DR
A vulnerability in Open5GS allows remote attackers to cause denial of service by sending a specially crafted Create Session Request message to the SMF (PGW-C) component. The attack exploits the PDN Address Allocation (PAA) field using a legitimate UE's IP address. This affects Open5GS deployments up to version 2.7.2.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the SMF component, affecting all UE sessions and preventing new connections in the affected network segment.
Likely Case
Targeted denial of service against specific UEs or network segments, causing service interruptions for affected users.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially causing only temporary service degradation.
🎯 Exploit Status
Exploitation requires understanding of 5G protocols and ability to craft valid Create Session Request messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.7.3 or later
Vendor Advisory: https://github.com/open5gs/open5gs/discussions/3919
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.7.3 or later. 3. Restart all Open5GS services. 4. Verify service functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to SMF (PGW-C) component to trusted network zones only
iptables -A INPUT -p tcp --dport <SMF_PORT> -s <TRUSTED_NETWORK> -j ACCEPT
iptables -A INPUT -p tcp --dport <SMF_PORT> -j DROP
Rate Limiting
linuxImplement rate limiting on Create Session Request messages
iptables -A INPUT -p tcp --dport <SMF_PORT> -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network access controls to limit SMF exposure
- Deploy intrusion detection systems monitoring for anomalous Create Session Request patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-smfd --version. If version is 2.7.2 or earlier, system is vulnerable.Check Version:
open5gs-smfd --versionVerify Fix Applied:
After patching, verify version is 2.7.3 or later and test SMF functionality with legitimate UE connections.📡 Detection & Monitoring
Log Indicators:
- Multiple failed Create Session Request attempts
- SMF service crashes or restarts
- Unusual PAA field values in session requests
Network Indicators:
- High volume of Create Session Request messages from single source
- Malformed 5G protocol packets targeting SMF port
SIEM Query:
source="open5gs-smf.log" AND ("Create Session Request" AND "PAA") | stats count by src_ip