CVE-2025-66786
📋 TL;DR
OpenAirInterface CN5G AMF versions up to v2.0.1 contain a logical error in JSON request processing that allows unauthenticated remote attackers to send malicious JSON data to the SBI interface, causing denial-of-service. This affects 5G core network deployments using vulnerable AMF components. Attackers can disrupt AMF service availability without authentication.
💻 Affected Systems
- OpenAirInterface CN5G AMF
📦 What is this software?
Oai Cn5g Amf by Openairinterface
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to 5G network unavailability for affected subscribers, preventing authentication and mobility management functions.
Likely Case
AMF service degradation or crashes requiring restart, causing temporary service interruptions for 5G subscribers.
If Mitigated
Minimal impact with proper network segmentation and request validation in place.
🎯 Exploit Status
Public PoC available in GitHub repository, exploitation requires sending specially crafted JSON to SBI endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > v2.0.1
Vendor Advisory: https://github.com/OPENAIRINTERFACE/openair-cn5g-amf
Restart Required: Yes
Instructions:
1. Update to latest OpenAirInterface CN5G AMF version > v2.0.1. 2. Verify patch includes JSON parsing validation fixes. 3. Restart AMF service after update.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to AMF SBI interface using firewall rules
iptables -A INPUT -p tcp --dport <sbi_port> -s <trusted_ips> -j ACCEPT
iptables -A INPUT -p tcp --dport <sbi_port> -j DROP
Request Rate Limiting
linuxImplement rate limiting on SBI interface to prevent DoS attempts
iptables -A INPUT -p tcp --dport <sbi_port> -m limit --limit 10/min --limit-burst 20 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network segmentation to isolate AMF from untrusted networks
- Deploy WAF or reverse proxy with JSON validation and request filtering
🔍 How to Verify
Check if Vulnerable:
Check AMF version with: ./amf --version or check package version. If version <= 2.0.1, system is vulnerable.Check Version:
./amf --version | grep -i versionVerify Fix Applied:
After patching, verify version > 2.0.1 and test JSON processing with valid/invalid requests.📡 Detection & Monitoring
Log Indicators:
- AMF crash logs
- JSON parsing errors in AMF logs
- Unusual SBI interface request patterns
Network Indicators:
- High volume of malformed JSON requests to AMF SBI port
- TCP connections to AMF SBI interface from unexpected sources
SIEM Query:
source="amf.log" AND ("JSON parse error" OR "malformed request" OR "SBI interface error")