PT-2026-1033 · Open5Gs · Open5Gs

Ziyulin · Published 2026-01-01 · Updated 2026-01-02 · CVE-2025-15417

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS versions through 2.7.6

Description A flaw exists in Open5GS related to the sgwc s11 handle create session request function within the GTPv2-C F-TEID Handler component, specifically in the file src/sgwc/s11-handler.c. Manipulation of this function can lead to a denial of service. The attack requires local access. The patch identified as 465273d13ba5d47b274c38c9d1b07f04859178a1 addresses this issue.

Recommendations Apply the patch 465273d13ba5d47b274c38c9d1b07f04859178a1 to versions through 2.7.6.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-15417

Affected Products

Open5Gs

References · 14

• 🔥 https://github.com/open5gs/open5gs/issues/4203#issue-3719257558 · Exploit
• https://github.com/open5gs/open5gs/issues/4203#issuecomment-3681643498 · Vendor Advisory
• https://github.com/open5gs/open5gs/issues/4203 · Vendor Advisory
• https://github.com/open5gs/open5gs/commit/465273d13ba5d47b274c38c9d1b07f04859178a1 · Patch
• https://osv.dev/vulnerability/CVE-2025-15417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15417 · Security Note
• https://t.me/CVEtracker/41202 · Telegram Post
• https://t.me/cveNotify/147463 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006870772757774438 · Twitter Post
• https://vuldb.com/?id.339339 · Note
• https://github.com/open5gs/open5gs · Note
• https://vuldb.com/?ctiid.339339 · Note
• https://twitter.com/CVEnew/status/2006876230134399418 · Twitter Post
• https://vuldb.com/?submit.727616 · Note