CVE-2025-8804
📋 TL;DR
This vulnerability in Open5GS AMF component allows remote attackers to trigger a reachable assertion via the ngap_build_downlink_nas_transport function, potentially causing denial of service. Affects Open5GS installations up to version 2.7.5. The exploit has been publicly disclosed and may be used against vulnerable systems.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker causes AMF service crash leading to denial of service for 5G network users
Likely Case
Service disruption affecting mobile network connectivity in affected areas
If Mitigated
Minimal impact with proper network segmentation and monitoring
🎯 Exploit Status
Exploit details are publicly available in GitHub repository, requires understanding of 5G NGAP protocol
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.7.6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Upgrade to Open5GS 2.7.6 using package manager or source compilation. 4. Apply patch bca0a7b6e01d254f4223b83831162566d4626428 if upgrading from source. 5. Restart Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict access to AMF interfaces to trusted networks only
iptables -A INPUT -p tcp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to AMF interfaces
- Deploy intrusion detection monitoring for NGAP protocol anomalies
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version | grep 'Open5GS AMF'Check Version:
open5gs-amfd --versionVerify Fix Applied:
Verify version is 2.7.6 or later and check for patch commit bca0a7b6e01d254f4223b83831162566d4626428 in git log📡 Detection & Monitoring
Log Indicators:
- AMF service crashes
- Assertion failures in ngap_build_downlink_nas_transport
- Unexpected NGAP protocol errors
Network Indicators:
- Malformed NGAP packets to port 38412
- Unusual traffic patterns to AMF interfaces
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "ngap_build_downlink_nas_transport")🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-8804
- https://github.com/open5gs/open5gs/commit/bca0a7b6e01d254f4223b83831162566d4626428
- https://github.com/open5gs/open5gs/issues/3950
- https://github.com/open5gs/open5gs/issues/3950#issuecomment-3034693457
- https://github.com/open5gs/open5gs/releases/tag/v2.7.6
- https://github.com/user-attachments/files/21030801/newdata_for_ngap.zip
- https://vuldb.com/?ctiid.319333
- https://vuldb.com/?id.319333
- https://vuldb.com/?submit.625698
- https://vuldb.com/?submit.626124
- https://github.com/open5gs/open5gs/issues/3950
