| Title | Open5GS v2.8.0 Improper Authorization leading to Denial of Service |
|---|
| Description | Open5GS 2.8.0 contains an improper authorization vulnerability in the AMF component when processing NGAP NG RESET messages with ResetType set to partOfNG-Interface.
An attacker controlling a gNB with an accepted NG association can send a crafted NG RESET message containing an AMF-UE-NGAP-ID assigned to a UE served by a different gNB. The AMF performs a global lookup of the referenced UE but does not verify that the UE belongs to the gNB that sent the reset request.
If the referenced UE has an active PDU session, the AMF initiates an asynchronous session release. When the release completes, the AMF resolves the legitimate owning gNB and reaches an assertion requiring gnb->ng_reset_ack to be non-NULL. Because the legitimate gNB did not initiate the reset, this value is NULL, causing an assertion failure and terminating the open5gs-amfd process with SIGABRT.
Successful exploitation results in a denial of service affecting all UEs served by the affected AMF, rather than only the referenced UE. Exploitation does not require control of the victim UE, a victim UE security context, or authenticated NAS signalling. The attacker must be able to establish an accepted N2/NGAP association with the AMF, such as through an attacker-controlled or compromised gNB in a deployment where the N2 interface is insufficiently protected.
The vulnerability is caused by the absence of an ownership check between the referenced RAN UE context and the gNB that submitted the NG RESET message. |
|---|
| Source | ⚠️ https://github.com/open5gs/open5gs/issues/4680 |
|---|
| User | dwxll (UID 99637) |
|---|
| Submission | 07/20/2026 06:22 (2 months ago) |
|---|
| Moderation | 09/05/2026 20:53 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399348 [Open5GS 2.7.7/2.8.0 AMF/MME improper authorization] |
|---|
| Points | 20 |
|---|