CVE-2025-9405
📋 TL;DR
A reachable assertion vulnerability in Open5GS AMF component allows remote attackers to cause denial of service by triggering an assertion failure in the gmm_state_exception function. This affects Open5GS deployments up to version 2.7.5 that expose the AMF service to untrusted networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the AMF component, disrupting 5G core network functionality and preventing new device registrations.
Likely Case
Service disruption and potential crash of the AMF process, requiring manual restart.
If Mitigated
Limited impact with proper network segmentation and monitoring to detect and respond to exploitation attempts.
🎯 Exploit Status
Public exploit code exists in the referenced GitHub repository. Attack requires network access to AMF service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3947
Restart Required: Yes
Instructions:
1. Update Open5GS to version after 2.7.5 or apply commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f. 2. Rebuild from source. 3. Restart AMF service.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict access to AMF service to trusted networks only
iptables -A INPUT -p tcp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit AMF service exposure
- Deploy monitoring and alerting for AMF process crashes or abnormal behavior
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version. If version is 2.7.5 or earlier, system is vulnerable.Check Version:
open5gs-amfd --versionVerify Fix Applied:
Verify commit hash includes 8e5fed16114f2f5e40bee1b161914b592b2b7b8f or version is later than 2.7.5📡 Detection & Monitoring
Log Indicators:
- AMF process crashes
- Assertion failures in gmm_state_exception
- Abnormal termination of amfd service
Network Indicators:
- Unusual traffic patterns to AMF port 38412
- Multiple connection attempts from single sources
SIEM Query:
process:amfd AND (event:crash OR event:assertion_failure)🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-9405
- https://github.com/open5gs/open5gs/commit/8e5fed16114f2f5e40bee1b161914b592b2b7b8f
- https://github.com/open5gs/open5gs/issues/3947
- https://github.com/open5gs/open5gs/issues/3947#issuecomment-3029992728
- https://github.com/user-attachments/files/21013084/amf_udm-uecm.zip
- https://vuldb.com/?ctiid.321241
- https://vuldb.com/?id.321241
- https://vuldb.com/?submit.633467
- https://github.com/open5gs/open5gs/issues/3947
- https://github.com/open5gs/open5gs/issues/3947#issuecomment-3029992728
- https://vuldb.com/?submit.633467
