PT-2026-21563 · Free5Gc · Smf+1

Published 2026-02-23 · Updated 2026-02-28 · CVE-2025-69232

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC go-upf versions up to and including 1.2.6 free5gc smf versions up to and including 1.4.0

Description The software contains an Improper Input Validation and Protocol Compliance issue that can lead to Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request to the UPF. The UPF incorrectly accepts this request, entering an inconsistent state that causes legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. PFCP stands for Protocol for Control Plane Communication, a protocol used for communication between the SMF and UPF.

Recommendations Apply the official patch once it is released.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-69232

GHSA-8M42-QW58-8362

Affected Products

Go-Upf

Smf

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69232.json · Exploit
• https://github.com/free5gc/free5gc/issues/745 · Vendor Advisory
• https://github.com/free5gc/free5gc/security/advisories/GHSA-8m42-qw58-8362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69232 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69232 · Vendor Advisory
• https://t.me/CVEtracker/45524 · Telegram Post
• https://t.me/cveNotify/152940 · Telegram Post
• https://twitter.com/cracbot/status/2027700411881447567 · Twitter Post
• https://twitter.com/cracbot/status/2027338111978746005 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026120571180679588 · Twitter Post
• https://twitter.com/CVEnew/status/2026184683512566073 · Twitter Post