PT-2025-43949 · Open5Gs · Open5Gs

Published 2025-10-27 · Updated 2025-11-24 · CVE-2025-41068

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.7.5

Description A reachable assertion issue in Open5GS up to version 2.7.5 can lead to a denial of service. An attacker with network access to the Network Repository Function (NRF) can exploit this by sending a Network Function (NF) creation request with an invalid type through the Service-based Interface (SBI). Subsequently, requesting data for this NF causes a process check within the NRF to fail, resulting in a crash and rendering the discovery service unavailable. The SBI is an API used for communication between network functions. The NRF is responsible for managing and discovering network functions.

Recommendations Update Open5GS to a version newer than 2.7.5.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2025-41068

Affected Products

Open5Gs

References · 8

• https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-41068 · Security Note
• https://open5gs.org/open5gs/release/2025/03/30/release-v2.7.5.html · Patch
• https://osv.dev/vulnerability/CVE-2025-41068 · Vendor Advisory
• https://t.me/CVEtracker/35841 · Telegram Post
• https://t.me/cveNotify/140635 · Telegram Post
• https://twitter.com/DavidMarquet19/status/1992865866413744554 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs · Note