PT-2025-52288 · Omec-Upf · Omec-Upf

Linziyuu · Published 2025-12-18 · Updated 2025-12-20 · CVE-2025-65564

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions omec-upf versions 2.1.3-dev

Description A denial-of-service issue exists in omec-upf. Specifically, when the UPF receives a PFCP Association Setup Request lacking the mandatory Recovery Time Stamp Information Element, the association setup handler attempts to dereference a nil pointer via IE.RecoveryTimeStamp() instead of validating the message. This leads to a process termination, effectively crashing the UPF. An attacker capable of sending PFCP Association Setup Request messages to the UPF’s N4/PFCP endpoint can exploit this to repeatedly crash the UPF and disrupt user-plane services. The vulnerable endpoint is the N4/PFCP endpoint. The vulnerable function is IE.RecoveryTimeStamp().

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider filtering or validating PFCP Association Setup Request messages to ensure the Recovery Time Stamp Information Element is present before processing them.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-65564

Affected Products

Omec-Upf

References · 6

• 🔥 https://github.com/omec-project/upf/issues/956 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65564 · Security Note
• https://github.com/omec-project/upf/pull/964 · Note
• https://twitter.com/CVEnew/status/2002487754241028251 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001759482100003211 · Twitter Post