CVE-2025-1925 in Open5GS
Summary
by MITRE • 03/04/2025
A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability identified as CVE-2025-1925 represents a critical denial of service flaw within the Open5GS network function, specifically affecting the Access and Mobility Management Function component. This issue resides in the amf_nsmf_pdusession_handle_update_sm_context function located within the src/amf/nsmf-handler.c file, making it a core component of the 5G core network's session management infrastructure. The vulnerability's classification as problematic indicates its potential to cause significant operational disruption within mobile network environments where Open5GS serves as the underlying software platform for network functions.
The technical exploitation of this vulnerability occurs through remote manipulation of the AMF's session management capabilities, specifically targeting the handling of PDU session context updates. When a malicious user equipment device sends crafted or malformed update requests to the AMF, the vulnerable function fails to properly validate or process these inputs, leading to an unhandled exception or memory corruption that causes the entire AMF process to crash. This flaw operates at the protocol handling level within the 5G core network architecture, directly impacting the network's ability to maintain session continuity for mobile subscribers. The vulnerability's remote exploitability means that attackers can initiate the attack from outside the network perimeter without requiring physical access or elevated privileges within the system.
The operational impact of CVE-2025-1925 extends far beyond individual user device connectivity, creating cascading failures throughout the entire network infrastructure. When a single user equipment device triggers this vulnerability, the AMF process becomes unavailable, resulting in complete disruption of mobility management and session handling services across the entire network. All registered user equipment devices lose their connectivity to the network, and new registration attempts are blocked until the AMF service is manually restarted, creating a service outage that affects the entire subscriber base. This high availability impact aligns with attack techniques documented in the MITRE ATT&CK framework under the denial of service category, specifically targeting network infrastructure components that serve as critical operational dependencies. The vulnerability's potential for network-wide outages makes it particularly dangerous in production environments where service continuity is paramount.
Network operators and security professionals should prioritize immediate patch deployment to address this vulnerability, as public disclosure increases the risk of exploitation. The vulnerability's presence in Open5GS versions up to 2.7.2 indicates that organizations running these versions are exposed to potential attacks, with the risk being particularly elevated in networks where the AMF serves as a central component of the 5G core architecture. The flaw's designates it as a CWE-20 category vulnerability, representing improper input validation, which is a fundamental security principle that should be enforced throughout network function implementations. Security teams should implement monitoring for suspicious session update patterns and consider implementing temporary network segmentation measures until the official patch is applied, as outlined in industry best practices for mitigating known vulnerabilities in telecommunications infrastructure.