Open5GS up to 2.7.5 AMF src/amf/gmm-sm.c gmm_state_de_registered/gmm_state_exception denial of service

Summaryinfo

A vulnerability was found in Open5GS up to 2.7.5. It has been declared as problematic. This affects the function gmm_state_de_registered/gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation results in denial of service. This vulnerability is reported as CVE-2025-8803. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Open5GS up to 2.7.5. Affected is the function gmm_state_de_registered/gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-8803. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499. The advisory points out:

The vulnerability in Open5GS <= v2.7.5 is caused by inadequate validation of service/API names in AMF when handling policy control requests, specifically for the npcf-am-policy-control service. An attacker can trigger a crafted signaling sequence — especially under resource-constrained environments — that causes the AMF’s GMM state machine to enter an invalid and undefined code path (gmm_state_security_mode), leading to a fatal assertion and crashing the AMF process. The AMF is a critical core network node responsible for access and mobility management, as well as interworking with SMF, PCF, and other NFs. Its failure can directly trigger cascading failures in dependent core components (e.g., SMF, PCF) due to disrupted signaling, incomplete policy control transactions, and session establishment failures, resulting in a network-wide service impact. Current CVSS scoring lists Scope as “Unchanged” (S:U), suggesting the impact is isolated. However, in practice, the crash extends beyond the AMF itself, causing systemic disruption across multiple network functions. The Scope should therefore be updated to “Changed” (S:C). Regarding Availability Impact, it is currently rated as “Low” (A:L). This rating assumes partial resource availability and no complete service outage. In reality, this vulnerability immediately terminates all in-progress registrations and prevents any new UE connections from being established. The outage persists after the attack until the affected core components are manually restarted or recovered, leaving critical network resources entirely unavailable. This meets the definition of “High” (A:H) availability impact, as the attack can cause a complete denial of service with lasting effects.

Upgrading to version 2.7.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1f30edac27f69f61cff50162e980fe58fdeb30ca is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24085). Further details are available at github.com. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Open5GS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5

License

• open-source

Website

• Product: https://github.com/open5gs/open5gs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #626123: Open5GS <= v2.7.5 Denial of Service (by xiaohan zheng)

Once again VulDB remains the best source for vulnerability data.

Discussion