CVE-2025-70123
📋 TL;DR
A protocol compliance vulnerability in free5GC's UPF component allows remote attackers to send malformed PFCP Association Setup Requests that violate 3GPP standards. This causes the UPF to enter an inconsistent state where subsequent legitimate PFCP Session Establishment Requests trigger cascading failures, disrupting SMF connections and causing service degradation. Organizations running free5GC v4.0.1 in 5G core networks are affected.
💻 Affected Systems
- free5GC
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service across the 5G core network, disrupting all user plane traffic and potentially affecting multiple network slices and services.
Likely Case
Service degradation affecting specific network slices or user groups, with intermittent connectivity issues and potential service disruptions.
If Mitigated
Limited impact to isolated UPF instances with proper network segmentation and monitoring in place.
🎯 Exploit Status
Exploitation requires knowledge of PFCP protocol and ability to send malformed packets to UPF interface. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.2 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/745
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update free5GC to v4.0.2 or later using git pull or package update. 3. Restart UPF service. 4. Verify PFCP association functionality.
🔧 Temporary Workarounds
Network ACL Restriction
LinuxRestrict PFCP traffic to trusted sources only using network access controls
iptables -A INPUT -p udp --dport 8805 -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate UPF from untrusted networks
- Deploy network monitoring for abnormal PFCP traffic patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check free5GC version: free5gc version | grep 'free5GC UPF'Check Version:
free5gc versionVerify Fix Applied:
Verify version is v4.0.2 or later and test PFCP association with valid/malformed requests📡 Detection & Monitoring
Log Indicators:
- UPF crash logs
- PFCP association failures
- SMF connection disruptions
- Error messages about malformed PFCP packets
Network Indicators:
- Unusual PFCP traffic patterns
- Multiple PFCP Association Setup Requests from single source
- Protocol violations in PFCP traffic
SIEM Query:
source="free5gc-upf.log" AND ("malformed" OR "protocol violation" OR "association failure")