CVE-2025-63288
📋 TL;DR
Open5GS AMF crashes when receiving a malformed NGSetupRequest message, causing denial of service for 5G core network users. This affects all deployments running vulnerable versions of Open5GS, potentially disrupting mobile network connectivity.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service outage, disrupting 5G network registration and mobility management for all users in affected area
Likely Case
Intermittent AMF crashes requiring manual restart, causing service disruptions and potential data loss
If Mitigated
Limited impact with proper monitoring and automated recovery mechanisms in place
🎯 Exploit Status
Attack requires sending specially crafted NGSetupRequest message to AMF interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.7 or apply commit be765fe2b03e350836272eee5afb3931bdfb86d5
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4087
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.7.7 or later. 2. Apply the specific commit if using custom build. 3. Restart AMF service. 4. Verify AMF is running and accepting connections.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to AMF NG interface to trusted gNB elements only
iptables -A INPUT -p sctp --dport 38412 -s trusted_gNB_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement rate limiting on AMF interface to prevent rapid exploitation
- Deploy AMF redundancy with automatic failover to minimize service disruption
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version. If version is 2.7.6 or earlier, system is vulnerable.Check Version:
open5gs-amfd --versionVerify Fix Applied:
After patching, verify AMF service remains running after receiving normal NGSetupRequest traffic📡 Detection & Monitoring
Log Indicators:
- AMF process crash/restart logs
- Unexpected NGSetupRequest messages
- Segmentation fault in AMF logs
Network Indicators:
- Abnormal SCTP packets to port 38412
- Repeated NGSetupRequest messages from single source
SIEM Query:
source="open5gs-amf.log" AND ("segmentation fault" OR "crash" OR "abnormal NGSetupRequest")