CVE-2025-8804 in Open5GS
Summary
by MITRE • 08/10/2025
A vulnerability has been found in Open5GS up to 2.7.5 and classified as problematic. Affected by this vulnerability is the function ngap_build_downlink_nas_transport of the component AMF. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.7.6 is able to address this issue. The identifier of the patch is bca0a7b6e01d254f4223b83831162566d4626428. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2025
The vulnerability identified as CVE-2025-8804 represents a critical assertion failure within the Open5GS network function AMF component, specifically within the ngap_build_downlink_nas_transport function. This flaw exists in Open5GS versions up to 2.7.5 and constitutes a significant security risk that has been publicly disclosed and actively exploited. The vulnerability manifests as an assertion that becomes reachable through remote exploitation, making it particularly dangerous for telecommunications infrastructure that relies on this open-source 5G core network implementation. The assertion failure occurs during the processing of downlink NAS transport messages within the NGAP protocol stack, which is fundamental to 5G network operations and user equipment communication.
The technical nature of this vulnerability places it squarely within the realm of software reliability failures, specifically categorized as a CWE-617 reachable assertion, which represents a condition where an assertion can be triggered by external inputs. This type of flaw typically occurs when the software does not properly validate input parameters or handle exceptional conditions during message processing. The AMF component serves as the 5G Access and Mobility Function, responsible for managing mobility, access authentication, and session management for user equipment within the 5G core network. When the ngap_build_downlink_nas_transport function encounters malformed or unexpected input during the construction of NGAP messages for downlink NAS transport, the assertion failure can cause the AMF process to terminate unexpectedly or enter an inconsistent state, potentially leading to service disruption and network instability.
The operational impact of this vulnerability extends beyond simple service interruption, as it directly affects the core functionality of 5G network operations. The remote exploit capability means that malicious actors can potentially cause denial of service conditions that disrupt legitimate user communications, which could be particularly damaging in mission-critical applications or emergency services. The exploitation of this vulnerability could enable attackers to perform network disruption attacks, potentially leading to unauthorized access to network resources or the ability to manipulate user equipment registration and authentication processes. This aligns with ATT&CK technique T1499.004 for network disruption and could be leveraged as part of broader attack campaigns targeting 5G infrastructure. The vulnerability's presence in the AMF component also raises concerns about the broader security posture of the 5G core network, as this function is critical for maintaining user equipment connectivity and network access control.
The recommended mitigation strategy involves upgrading to Open5GS version 2.7.6, which includes the patch identified by the commit hash bca0a7b6e01d254f4223b83831162566d4626428. This upgrade addresses the underlying assertion failure by implementing proper input validation and error handling within the ngap_build_downlink_nas_transport function. Organizations should prioritize this upgrade as a critical security measure, particularly given that the exploit has been publicly disclosed and is actively being used in the wild. Network operators should also implement monitoring for unusual AMF process behavior or unexpected termination events that could indicate exploitation attempts. The fix demonstrates proper software engineering practices by ensuring that assertions are either removed from production code or properly guarded against external manipulation, which aligns with industry best practices for robust software development and security hardening of telecommunications infrastructure components.