Open5GS up to 2.7.5 src/amf/gmm-sm.c gmm_state_exception assertion

Summaryinfo

A vulnerability marked as problematic has been reported in Open5GS up to 2.7.5. This affects the function gmm_state_exception of the file src/amf/gmm-sm.c. This manipulation causes assertion. This vulnerability is handled as CVE-2025-9405. The attack can be initiated remotely. Additionally, an exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability has been found in Open5GS up to 2.7.5 and classified as problematic. Affected by this vulnerability is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipulation with an unknown input leads to a assertion vulnerability. The CWE definition for the vulnerability is CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. As an impact it is known to affect availability.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-9405. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The advisory points out:

The vulnerability in Open5GS AMF (CVE-2025-9405) arises when the AMF receives a delayed or asynchronous SBI response (e.g., from nudm-uecm) after the UE context has already been removed. This results in an invalid state machine transition and triggers an AMF crash. As the AMF is a critical control-plane component for registration, session, and mobility management, its failure can propagate to other dependent network functions (e.g., SMF), leading to cascading failures and a system-wide disruption rather than an isolated impact. The current CVSS scoring lists Scope as “Unchanged” (S:U), suggesting that the impact is confined to the AMF. In reality, the crash of the AMF directly affects other core functions and destabilizes the entire 5G core signaling path. The Scope should therefore be revised to “Changed” (S:C), as the vulnerability extends beyond the initial component to other interconnected nodes. Regarding Availability Impact, it is currently rated as “Low” (A:L). This classification assumes that partial service remains available and the attack cannot fully deny service. However, this vulnerability completely terminates all existing UE sessions and prevents any new registrations or connections. The denial of service persists after the attack until the AMF is manually restarted or recovered, leaving critical resources entirely inaccessible. This matches the definition of “High” (A:H) availability impact, since the attack causes a total loss of service with lasting consequences, including both the disruption of active connections and the inability to establish new ones.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Applying the patch 8e5fed16114f2f5e40bee1b161914b592b2b7b8f is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-25719). Additional details are provided at github.com. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Open5GS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5

License

• open-source

Website

• Product: https://github.com/open5gs/open5gs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #633467: Open5GS <= v2.7.5 Denial of Service (by ZYC010101)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion