CVE-2025-1893

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1893
A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. The patch is named e31e9965f00d9c744a7f728497cb4f3e97744ee8. It is recommended to apply a patch to fix this issue.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/open5gs/open5gs/commit/e31e9965f00d9c744a7f728497cb4f3e97744ee8 Patch
https://github.com/open5gs/open5gs/issues/3707 Exploit Issue Tracking
https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 Exploit Issue Tracking
https://github.com/open5gs/open5gs/issues/3707#issuecomment-2639620554 Exploit Issue Tracking
https://vuldb.com/?ctiid.298411 Permissions Required
https://vuldb.com/?id.298411 Exploit Third Party Advisory
https://vuldb.com/?submit.505952 Third Party Advisory
https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
History

06 Mar 2025, 12:21

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en Open5GS hasta la versión 2.7.2. Se ha declarado como problemática. La vulnerabilidad afecta a la función gmm_state_authentication del archivo src/amf/gmm-sm.c del componente UDM Subscriber Data Management. La manipulación provoca una denegación de servicio. El ataque se puede lanzar de forma remota. El exploit se ha hecho público y puede utilizarse. El parche se llama e31e9965f00d9c744a7f728497cb4f3e97744ee8. Se recomienda aplicar un parche para solucionar este problema.
CPE cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
First Time Open5gs open5gs
Open5gs
References () https://github.com/open5gs/open5gs/commit/e31e9965f00d9c744a7f728497cb4f3e97744ee8 - () https://github.com/open5gs/open5gs/commit/e31e9965f00d9c744a7f728497cb4f3e97744ee8 - Patch
References () https://github.com/open5gs/open5gs/issues/3707 - () https://github.com/open5gs/open5gs/issues/3707 - Exploit, Issue Tracking
References () https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 - () https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 - Exploit, Issue Tracking
References () https://github.com/open5gs/open5gs/issues/3707#issuecomment-2639620554 - () https://github.com/open5gs/open5gs/issues/3707#issuecomment-2639620554 - Exploit, Issue Tracking
References () https://vuldb.com/?ctiid.298411 - () https://vuldb.com/?ctiid.298411 - Permissions Required
References () https://vuldb.com/?id.298411 - () https://vuldb.com/?id.298411 - Exploit, Third Party Advisory
References () https://vuldb.com/?submit.505952 - () https://vuldb.com/?submit.505952 - Third Party Advisory

04 Mar 2025, 17:15

Type Values Removed Values Added
References () https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 - () https://github.com/open5gs/open5gs/issues/3707#issue-2833194192 -

04 Mar 2025, 13:15

Type Values Removed Values Added
Summary (en) A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication of the file src/amf/gmm-sm.c of the component UDM Subscriber Data Management. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named e31e9965f00d9c744a7f728497cb4f3e97744ee8. It is recommended to apply a patch to fix this issue. (en) A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. The patch is named e31e9965f00d9c744a7f728497cb4f3e97744ee8. It is recommended to apply a patch to fix this issue.

04 Mar 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-04 01:15

Updated : 2025-03-06 12:21

NVD link : CVE-2025-1893

Mitre link : CVE-2025-1893

CVE.ORG link : CVE-2025-1893

JSON object : View

Products Affected

open5gs

  • open5gs
CWE
CWE-404

Improper Resource Shutdown or Release