PT-2025-9575 · Open5Gs · Open5Gs

Enginerstaticpower + 6 · Published 2025-03-04 · Updated 2025-06-03 · CVE-2025-1893

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.7.2

Description A denial of service issue has been found in the gmm state authentication function of the file src/amf/gmm-sm.c in the component AMF. This issue can be exploited remotely, leading to a network-wide outage, causing all registered UEs to lose connectivity, and blocking new registrations until the AMF is restarted. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch named e31e9965f00d9c744a7f728497cb4f3e97744ee8 to the affected Open5GS version. As a temporary workaround, consider restricting access to the gmm state authentication function until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-1893

Affected Products

Open5Gs

References · 14

• 🔥 https://github.com/open5gs/open5gs/issues/3707#issuecomment-2639620554 · Exploit
• 🔥 https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 · Exploit
• 🔥 https://github.com/open5gs/open5gs/issues/3707 · Exploit
• 🔥 https://vuldb.com/?id.298411 · Exploit
• https://github.com/open5gs/open5gs/commit/e31e9965f00d9c744a7f728497cb4f3e97744ee8 · Patch
• https://osv.dev/vulnerability/CVE-2025-1893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1893 · Security Note
• https://t.me/cvetracker/25308 · Telegram Post
• https://vuldb.com/?submit.505952 · Note
• https://twitter.com/CVEnew/status/1896767550437920882 · Twitter Post
• https://vuldb.com/?ctiid.298411 · Note
• https://t.me/cvenotify/113353 · Telegram Post
• https://t.me/cvenotify/113281 · Telegram Post
• https://t.me/cvedetector/19442 · Telegram Post