CVE-2025-5935
📋 TL;DR
A denial-of-service vulnerability in Open5GS AMF/MME component allows remote attackers to crash the service by manipulating the ran_ue_id argument in the common_register_state function. This affects Open5GS deployments up to version 2.7.3. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the AMF/MME component, potentially affecting mobile network connectivity for all users served by the vulnerable instance.
Likely Case
Service crashes requiring manual restart, causing temporary service outages and potential call/session drops.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit code has been publicly disclosed in GitHub issues and attachments. Attack requires network access to the AMF/MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: After commit 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5
Vendor Advisory: https://github.com/open5gs/open5gs/commit/62cb99755243c9c38e4c060c5d8d0e158fe8cdd5
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5. 2. Rebuild from source if using source installation. 3. Restart all AMF/MME services.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to AMF/MME interfaces to trusted networks only
iptables -A INPUT -p tcp --dport <AMF_PORT> -s <TRUSTED_NETWORK> -j ACCEPT
iptables -A INPUT -p tcp --dport <AMF_PORT> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to AMF/MME interfaces
- Deploy monitoring and automated restart mechanisms to detect and recover from crashes
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version is 2.7.3 or earlier, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
Verify commit 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5 is present in git log or version is newer than 2.7.3.📡 Detection & Monitoring
Log Indicators:
- AMF/MME service crashes
- Unexpected termination of mmed process
- Error logs mentioning common_register_state or ran_ue_id
Network Indicators:
- Unusual traffic patterns to AMF/MME ports
- Multiple connection attempts with malformed RAN UE IDs
SIEM Query:
process_name:"open5gs-mmed" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://github.com/open5gs/open5gs/commit/62cb99755243c9c38e4c060c5d8d0e158fe8cdd5
- https://github.com/open5gs/open5gs/issues/3874
- https://github.com/open5gs/open5gs/issues/3874#issuecomment-2853547622
- https://github.com/user-attachments/files/19863206/Problematic.handover.required.process.zip
- https://vuldb.com/?ctiid.311713
- https://vuldb.com/?id.311713
- https://vuldb.com/?submit.589354
