PT-2026-8294 · Open5Gs · Open5Gs

Linziyu · Published 2026-02-15 · Updated 2026-03-19 · CVE-2026-2523

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.7

Description An issue exists in Open5GS up to version 2.7.6 related to the smf gn handle create pdp context request function within the SMF component, specifically in the file /src/smf/gn-handler.c. The manipulation of this function results in a reachable assertion. The attack can be launched remotely. The exploit is publicly available.

Recommendations Update Open5GS to version 2.7.7 or later. As a temporary workaround, consider restricting access to the smf gn handle create pdp context request function until a patch is available.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2026-02015

CVE-2026-2523

Affected Products

Open5Gs

References · 14

• 🔥 https://github.com/open5gs/open5gs/issues/4285#issue-3809055236 · Exploit
• https://github.com/open5gs/open5gs/issues/4285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2523 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2523 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02015 · Security Note
• https://github.com/open5gs/open5gs · Note
• https://vuldb.com/?ctiid.346111 · Note
• https://vuldb.com/?id.346111 · Note
• https://vuldb.com/?submit.738342 · Note
• https://twitter.com/CVEarity/status/2023285047579836572 · Twitter Post
• https://twitter.com/DarkForgeNews/status/2034650518539407461 · Twitter Post
• https://t.me/CVEtracker/44780 · Telegram Post
• https://t.me/cveNotify/152072 · Telegram Post
• https://twitter.com/CVEnew/status/2023208432925343750 · Twitter Post