Open5GS up to 2.7.5 AMF ngap_build_downlink_nas_transport assertion

Summaryinfo

A vulnerability was found in Open5GS up to 2.7.5. It has been rated as problematic. This vulnerability affects the function ngap_build_downlink_nas_transport of the component AMF. This manipulation causes assertion. This vulnerability appears as CVE-2025-8804. The attack may be initiated remotely. In addition, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Open5GS up to 2.7.5 and classified as problematic. Affected by this vulnerability is the function ngap_build_downlink_nas_transport of the component AMF. The manipulation with an unknown input leads to a assertion vulnerability. The CWE definition for the vulnerability is CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. As an impact it is known to affect availability.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-8804. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The advisory points out:

The vulnerability in Open5GS AMF occurs when SM Context creation fails during the initial context setup procedure. Due to insufficient error handling, the AMF process crashes immediately upon this failure condition. The AMF (Access and Mobility Management Function) is a critical 5G core network function responsible for user registration, connection management, and mobility procedures. Its failure directly impacts other dependent core components such as the SMF (Session Management Function) and UPF (User Plane Function) because the crash disrupts ongoing signaling and invalidates active session contexts. As a result, the problem is not limited to the AMF process itself — it propagates to multiple network functions, causing a broader systemic disruption. Scope justification The current CVSS scoring lists Scope as “Unchanged” (S:U), implying the impact remains confined to the vulnerable component. However, in practice, an AMF crash due to this flaw disrupts cross-component signaling flows, invalidates active SM contexts, and forces dependent NFs to enter error states. This constitutes a security impact that extends beyond the AMF’s own security scope, and thus the Scope should be updated to “Changed” (S:C). Availability Impact justification Availability Impact is currently rated as “Low” (A:L), assuming partial service degradation. In reality, this vulnerability terminates all active UE sessions, rejects all new registration attempts, and persists until the AMF process is manually restarted. Critically, once the AMF is offline: New UEs cannot complete network registration — preventing any new device from accessing the network. Already-registered UEs cannot perform periodic registration updates — leading to session expiration and eventual detachment from the network. Given the AMF’s central role in core network operation, this condition results in a complete denial of registration and session establishment across the network, fulfilling the definition of “High” (A:H) availability impact.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Upgrading to version 2.7.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch bca0a7b6e01d254f4223b83831162566d4626428 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24084). Additional details are provided at github.com. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Open5GS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5

License

• open-source

Website

• Product: https://github.com/open5gs/open5gs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #626124: Open5GS <=v2.7.5 Denail of Service (by lixxxiang)

Duplicate

• Submit #XXXXXX: Xxxxxxx <= Xx.x.x Xxxxxx Xx Xxxxxxx (by xiaohan zheng)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion