CVE-2025-8800
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS AMF component where the esm_handle_pdn_connectivity_request function can be manipulated by remote attackers. This affects Open5GS deployments up to version 2.7.5, potentially disrupting 5G core network services.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of AMF services leading to denial of 5G network connectivity for affected users
Likely Case
Service degradation or temporary unavailability of AMF component
If Mitigated
Minimal impact with proper network segmentation and monitoring
🎯 Exploit Status
Exploitation requires understanding of 5G NAS protocol and ability to send crafted PDN connectivity requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.7.6
Restart Required: Yes
Instructions:
1. Backup current configuration
2. Stop Open5GS services
3. Upgrade to Open5GS 2.7.6 using package manager or source compilation
4. Apply commit 701505102f514cbde2856cd2ebc9bedb7efc820d if building from source
5. Restart Open5GS services
🔧 Temporary Workarounds
Network segmentation
LinuxRestrict access to AMF component to trusted networks only
iptables -A INPUT -p tcp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to AMF component
- Deploy intrusion detection systems to monitor for anomalous PDN connectivity requests
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version | grep '2.7' and verify if version is <= 2.7.5Check Version:
open5gs --versionVerify Fix Applied:
Verify version is 2.7.6 or later and check git log for commit 701505102f514cbde2856cd2ebc9bedb7efc820d📡 Detection & Monitoring
Log Indicators:
- AMF crash logs
- Unusual PDN connectivity request patterns
- Service restart events
Network Indicators:
- Abnormal NAS protocol traffic to AMF
- Multiple failed PDN connectivity requests from single source
SIEM Query:
source="open5gs.log" AND ("AMF crash" OR "esm_handle_pdn_connectivity_request" AND error)🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-8800
- https://github.com/open5gs/open5gs/commit/701505102f514cbde2856cd2ebc9bedb7efc820d
- https://github.com/open5gs/open5gs/issues/3980
- https://github.com/open5gs/open5gs/issues/3980#issuecomment-3054894281
- https://github.com/open5gs/open5gs/releases/tag/v2.7.6
- https://vuldb.com/?ctiid.319328
- https://vuldb.com/?id.319328
- https://vuldb.com/?submit.626113
- https://github.com/open5gs/open5gs/issues/3980
