PT-2025-23617 · Open5Gs · Open5Gs

Sq0409

·

Published

2025-06-03

·

Updated

2025-06-14

·

CVE-2025-5501

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.7.3
Description A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Recommendations To fix this issue, apply the patch named 2daa44adab762c47a8cef69cc984946973a845b3 for versions up to 2.7.3. As a temporary workaround, consider disabling the ngap handle path switch request transfer function until a patch is available.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2025-5501

Affected Products

Open5Gs