CVE-2025-8801
📋 TL;DR
This vulnerability in Open5GS AMF component allows remote attackers to cause denial of service by exploiting a flaw in the gmm_state_exception function. Systems running Open5GS versions up to 2.7.5 are affected. The vulnerability can be triggered remotely without authentication.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to 5G network unavailability for affected subscribers
Likely Case
AMF service crashes requiring manual restart, causing temporary service interruption
If Mitigated
Limited impact with proper network segmentation and monitoring
🎯 Exploit Status
Exploit details publicly disclosed in GitHub repository; remote exploitation demonstrated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.7.6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Upgrade to version 2.7.6 via package manager or source compilation. 4. Apply patch f47f2bd4f7274295c5fbb19e2f806753d183d09a if compiling from source. 5. Restart Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict network access to AMF component to trusted sources only
iptables -A INPUT -p tcp --dport [AMF_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [AMF_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit AMF exposure
- Deploy rate limiting and monitoring for AMF service anomalies
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version | grep '2.7'Check Version:
open5gs-amfd --versionVerify Fix Applied:
Verify version is 2.7.6 or later: open5gs-amfd --version📡 Detection & Monitoring
Log Indicators:
- AMF service crashes
- gmm_state_exception errors
- unexpected AMF restarts
Network Indicators:
- Unusual traffic patterns to AMF port
- Multiple connection attempts from single source
SIEM Query:
source="open5gs.log" AND ("AMF crash" OR "gmm_state_exception" OR "segmentation fault")🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-8801
- https://github.com/open5gs/open5gs/commit/f47f2bd4f7274295c5fbb19e2f806753d183d09a
- https://github.com/open5gs/open5gs/issues/3977
- https://github.com/open5gs/open5gs/issues/3977#issuecomment-3052575886
- https://github.com/open5gs/open5gs/releases/tag/v2.7.6
- https://github.com/user-attachments/files/21095572/nudm-sdm.zip
- https://vuldb.com/?ctiid.319329
- https://vuldb.com/?id.319329
- https://vuldb.com/?submit.626118
- https://github.com/open5gs/open5gs/issues/3977
