CVE-2025-15176
⚪ Do wiadomości
Błąd w Open5GS umożliwia zdalne wywołanie asercji w obsłudze żądania sesji PFCP.
CVSS
5.3
EPSS
0.6%
Exploit
poc
Vendor
open5gs
Opis źródłowy (NVD)
A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.6% |
| Opublikowano (NVD) | 2025-12-29 07:15:54 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-05 18:10:00 UTC |
Referencje
- https://github.com/open5gs/open5gs/ ([email protected])
- https://github.com/open5gs/open5gs/commit/b72d8349980076e2c033c8324f07747a86eea4f8 ([email protected]) [Patch]
- https://github.com/open5gs/open5gs/issues/4180 ([email protected]) [Exploit, Issue Tracking]
- https://github.com/open5gs/open5gs/issues/4180#issue-3666760066 ([email protected]) [Exploit, Issue Tracking]
- https://github.com/open5gs/open5gs/issues/4180#issuecomment-3615555671 ([email protected]) [Exploit, Issue Tracking]
- https://vuldb.com/?ctiid.338561 ([email protected]) [Permissions Required, VDB Entry]
- https://vuldb.com/?id.338561 ([email protected]) [Third Party Advisory, VDB Entry]
- https://vuldb.com/?submit.719830 ([email protected]) [Exploit, Third Party Advisory, VDB Entry]