CVE-2026-1586
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS SGWC component where remote attackers can manipulate the ogs_gtp2_f_teid_to_ip function to crash the service. This affects Open5GS deployments up to version 2.7.5 that have SGWC exposed to untrusted networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers cause complete SGWC service disruption, affecting all 5G core network functions dependent on SGWC connectivity.
Likely Case
Service crashes requiring manual restart, causing temporary 5G core network service interruption.
If Mitigated
Minimal impact with proper network segmentation and monitoring that detects and blocks exploitation attempts.
🎯 Exploit Status
Exploit details published in GitHub issues, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6 and later
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4273
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.7.6 or later. 2. Restart all Open5GS services. 3. Verify SGWC component is running correctly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to SGWC component to trusted internal networks only
iptables -A INPUT -p tcp --dport [SGWC_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [SGWC_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SGWC exposure to only trusted internal networks.
- Deploy network monitoring and intrusion detection systems to detect and block exploitation attempts targeting SGWC.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version. If version is 2.7.5 or earlier, system is vulnerable.Check Version:
open5gs --versionVerify Fix Applied:
Verify Open5GS version is 2.7.6 or later and SGWC service is running without crashes after applying patch.📡 Detection & Monitoring
Log Indicators:
- SGWC service crashes or restarts
- Error logs mentioning ogs_gtp2_f_teid_to_ip function failures
- Unexpected process termination in SGWC logs
Network Indicators:
- Unusual traffic patterns to SGWC port
- Malformed GTP packets targeting SGWC
SIEM Query:
source="open5gs.logs" AND ("crash" OR "segfault" OR "ogs_gtp2_f_teid_to_ip")🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/issues/4273
- https://github.com/open5gs/open5gs/issues/4273#event-21968643659
- https://github.com/open5gs/open5gs/issues/4273#issue-3796030721
- https://vuldb.com/?ctiid.343349
- https://vuldb.com/?id.343349
- https://vuldb.com/?submit.738375
