PT-2025-26170 · Open5Gs · Open5Gs

Cmdcsop · Published 2025-06-18 · Updated 2026-01-09 · CVE-2025-44951

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions open5gs versions 2.7.2 and earlier

Description A missing length check in the ogs pfcp dev add function from the PFCP library allows a local attacker to cause a Buffer Overflow by changing the session.dev field with a value with length greater than 32. This issue affects both smf and upf in open5gs.

Recommendations For open5gs versions 2.7.2 and earlier, as a temporary workaround, consider disabling the ogs pfcp dev add function until a patch is available. Restrict access to the PFCP library to minimize the risk of exploitation. Avoid using the session.dev field with values longer than 32 characters in the affected API endpoints until the issue is resolved.

Exploit

Fix

LPE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-44951

Affected Products

Open5Gs

References · 13

• 🔥 https://github.com/open5gs/open5gs/issues/3775 · Exploit
• 🔥 https://gist.github.com/scmdcs/6d878d6074f0e2f4a8fb69e9864068b7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-44951 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44951 · Vendor Advisory
• https://github.com/open5gs/open5gs/commit/e3dd98cd291fba233a46adb2881213fc6e38b924 · Note
• https://t.me/cveNotify/148278 · Telegram Post
• https://twitter.com/cracbot/status/1937103414586147257 · Twitter Post
• https://t.me/cvenotify/128245 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1935411752801308757 · Twitter Post
• https://twitter.com/CVEnew/status/1935727422013346019 · Twitter Post
• https://gist.github.com/scemodicecosa/6d878d6074f0e2f4a8fb69e9864068b7 · Note
• https://t.me/cvetracker/26516 · Telegram Post
• https://t.me/latest_high_impact_cve/2710 · Telegram Post