Overview
The open5GS network software, specifically version 2.7.2 and earlier, exhibits a critical vulnerability, identified as CVE-2025-44952, that could potentially allow a local attacker to compromise the system or lead to data leakage. Open5GS is an open-source project used to implement 5G systems, and its compromise could negatively impact telecommunications providers and their clients, making this a significant cybersecurity concern. The vulnerability resides in the PFCP (Packet Forwarding Control Protocol) library, a critical component of the network software.
Vulnerability Summary
CVE ID: CVE-2025-44952
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Open5GS | 2.7.2 and earlier
How the Exploit Works
The vulnerability arises from a missing length check in the `ogs_pfcp_subnet_add` function, which is used by both the Session Management Function (smf) and the User Plane Function (upf) in Open5GS. By manipulating the `session.dnn` field with a value exceeding 101 characters in length, an attacker can cause a buffer overflow. This overflow can create a critical error state, potentially allowing an attacker to execute arbitrary code or cause a system crash.
Conceptual Example Code
In a conceptual context, the vulnerability might be exploited as follows:
# Exploit for CVE-2025-44952
# This is a simplified representation and may not work as it is
#!/bin/bash
# Generate a string of characters longer than 101
payload=$(printf 'A%.0s' {1..102})
# Use the payload to exploit the vulnerability
echo "$payload" > /proc/[pid]/session.dnnIn this conceptual example, the payload is a string of 102 ‘A’ characters. When written to the `session.dnn` field, it triggers a buffer overflow due to the missing length check in the `ogs_pfcp_subnet_add` function.
Recommendations
The best mitigation against this vulnerability is to apply the vendor’s patch. In cases where immediate patching is not feasible, deploying a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can provide temporary protection. However, these measures are not foolproof and can only serve as a stop-gap while the patch is being applied. It is strongly recommended to update the Open5GS software to the latest version where this vulnerability has been addressed.