CVE-2025-60632
📋 TL;DR
This vulnerability in Free5GC allows attackers to cause denial of service by sending specially crafted POST requests to the Npcf_BDTPolicyControl API. Systems running Free5GC v4.0.0 or v4.0.1 are affected, potentially disrupting 5G core network functionality.
💻 Affected Systems
- Free5GC
📦 What is this software?
Free5gc by Free5gc
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the Free5GC instance, affecting all 5G core network functions dependent on the affected component.
Likely Case
Temporary service degradation or unavailability of the Npcf_BDTPolicyControl API, impacting bandwidth management and policy control functions.
If Mitigated
Minimal impact with proper rate limiting, input validation, and network segmentation in place.
🎯 Exploit Status
Crafting malicious POST requests requires minimal technical skill based on the CWE-617 description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.2 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/705
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Free5GC to v4.0.2 or later using git pull or package manager. 3. Restart all Free5GC services. 4. Verify functionality.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to the Npcf_BDTPolicyControl API endpoint to trusted IP addresses only.
iptables -A INPUT -p tcp --dport [API_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [API_PORT] -j DROP
Rate Limiting
allImplement request rate limiting on the API endpoint to prevent DoS attacks.
# Configure using nginx or similar reverse proxy with rate limiting rules
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Free5GC instance from untrusted networks.
- Deploy a Web Application Firewall (WAF) with DoS protection rules in front of the API endpoint.
🔍 How to Verify
Check if Vulnerable:
Check Free5GC version: free5gc version | grep -E '4\.0\.0|4\.0\.1'Check Version:
free5gc versionVerify Fix Applied:
Confirm version is v4.0.2 or later: free5gc version | grep -E '4\.0\.2|4\.[1-9]'📡 Detection & Monitoring
Log Indicators:
- Unusual volume of POST requests to /npcf-bdtpolicycontrol endpoint
- Error logs indicating malformed requests or service crashes
Network Indicators:
- High volume of HTTP POST traffic to port 29507 (default Npcf port)
- Abnormal request patterns to the API endpoint
SIEM Query:
source="free5gc.log" AND "POST /npcf-bdtpolicycontrol" AND status=400|500