CVE-2026-1587
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS SGWC component where the sgwc_s11_handle_modify_bearer_request function can be remotely triggered to crash the service. This affects Open5GS deployments up to version 2.7.6. The vulnerability allows attackers to disrupt 5G core network functionality.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of SGWC service leading to loss of 5G session management capabilities, affecting user connectivity and network operations.
Likely Case
Service crashes requiring manual restart, causing temporary service disruption for affected users.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.7 or later
Vendor Advisory: https://github.com/open5gs/open5gs/issues/4272
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.7.7 or later. 2. Restart all SGWC services. 3. Verify the patch is applied by checking version.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to SGWC S11 interface to trusted networks only
iptables -A INPUT -p tcp --dport 2123 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 2123 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S11 interface exposure
- Deploy monitoring and alerting for SGWC service crashes with automated restart capabilities
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: if version <= 2.7.6 and SGWC is running, system is vulnerable.Check Version:
open5gs --versionVerify Fix Applied:
Verify Open5GS version is 2.7.7 or later and SGWC service remains stable under normal traffic.📡 Detection & Monitoring
Log Indicators:
- SGWC service crashes
- Unexpected termination of sgwc process
- Error logs mentioning sgwc_s11_handle_modify_bearer_request
Network Indicators:
- Unusual S11 interface traffic patterns
- Multiple modify bearer requests from single source
SIEM Query:
process:sgwc AND (event:crash OR event:terminated)🔗 References
- https://github.com/open5gs/open5gs/
- https://github.com/open5gs/open5gs/issues/4272
- https://github.com/open5gs/open5gs/issues/4272#event-21968635948
- https://github.com/open5gs/open5gs/issues/4272#issue-3795156752
- https://vuldb.com/?ctiid.343350
- https://vuldb.com/?id.343350
- https://vuldb.com/?submit.738376
