Open5GS up to 2.7.5 AMF src/amf/gmm-sm.c gmm_state_exception denial of service

Summaryinfo

A vulnerability has been found in Open5GS up to 2.7.5 and classified as problematic. Affected is the function gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2025-8801. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Open5GS up to 2.7.5. This affects the function gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-8801. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1499 for this issue. The advisory points out:

The vulnerability in Open5GS AMF occurs when it receives a delayed smf-select-data response from nudm-sdm after the UE context has already been removed. In this case, the UE is in the DEREGISTERED state, but the AMF still dispatches the late SBI event to the GMM state machine. Since there is no valid handler for this state/event combination, the GMM state machine hits a fatal should not be reached assertion in gmm_state_exception, causing the AMF process to crash. The AMF (Access and Mobility Management Function) is a critical 5G core network function responsible for UE registration, mobility management, and session initiation coordination with the SMF. An AMF crash disrupts both the control-plane and dependent network functions (e.g., SMF, UDM) due to lost UE contexts and broken signaling flows. The issue is not confined to the AMF process—it cascades to other core functions, affecting the entire 5G core service. Scope justification The current CVSS scoring lists Scope as “Unchanged” (S:U), implying the impact remains confined to the AMF. In practice, an AMF crash due to this flaw disrupts cross-component control flows, invalidates ongoing SMF procedures, and forces dependent NFs into error states. It also leaves UDM subscription and session data in inconsistent states. This constitutes a security impact that extends beyond the AMF’s own security scope, and thus the Scope should be updated to “Changed” (S:C). Availability Impact justification Availability Impact is currently rated as “Low” (A:L), assuming partial service degradation. In reality, this vulnerability causes: Immediate termination of all active UE sessions — all registered devices lose signaling association. Rejection of all new registration attempts — no new UEs can access the network. Failure of periodic registration updates for already-registered UEs — leading to eventual session expiry and detachment. The outage persists until the AMF process is manually restarted. Given the AMF’s central role in 5G core operation and its impact on both new and existing subscribers, this meets the definition of “High” (A:H) availability impact, as it results in a complete denial of mobility and registration services across the network.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Upgrading to version 2.7.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch f47f2bd4f7274295c5fbb19e2f806753d183d09a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24083). Further details are available at github.com. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒

CVSSv3info

VulDB Meta Base Score: 6.7
VulDB Meta Temp Score: 6.3

VulDB Base Score: 5.3
VulDB Temp Score: 4.8
VulDB Vector: 🔒
VulDB Reliability: 🔍

Researcher Base Score: 8.6
Researcher Vector: 🔒

NVD Base Score: 7.5
NVD Vector: 🔒

CNA Base Score: 5.3
CNA Vector: 🔒

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Denial of service
CWE: CWE-404
CAPEC: 🔒
ATT&CK: 🔒

Physical: No
Local: No
Remote: Yes

Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒

EPSS Score: 🔒
EPSS Percentile: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Open5GS 2.7.6
Patch: f47f2bd4f7274295c5fbb19e2f806753d183d09a

Timelineinfo

08/09/2025 Advisory disclosed
08/09/2025 +0 days VulDB entry created
08/15/2025 +6 days VulDB entry last update

Sourcesinfo

Product: github.com

Advisory: 3977
Status: Confirmed
Confirmation: 🔒

CVE: CVE-2025-8801 (🔒)
GCVE (CVE): GCVE-0-2025-8801
GCVE (VulDB): GCVE-100-319329
EUVD: 🔒
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔒

Entryinfo

Created: 08/09/2025 09:21
Updated: 08/15/2025 16:50
Changes: 08/09/2025 09:21 (62), 08/10/2025 14:01 (31), 08/10/2025 16:03 (1), 08/15/2025 15:43 (13), 08/15/2025 15:46 (3), 08/15/2025 16:50 (12)
Complete: 🔍
Submitter: lixxxiang
Committer: lixxxiang
Cache ID: 216::103

Submitinfo

Accepted

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!