Riskcovery

CVE-2025-8805

Open5GS SMF gsm-sm.c smf_gsm_state_wait_pfcp_deletion denial of service

State
Published
Severity
6.9 Medium
Published
Aug 10, 2025
Updated
Aug 15, 2025
Reserved
Aug 9, 2025

Read the record on cve.org

Description

A vulnerability was determined in Open5GS up to 2.7.5. Affected by this issue is the function smf_gsm_state_wait_pfcp_deletion of the file src/smf/gsm-sm.c of the component SMF. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.7.6 is able to address this issue. The patch is identified as c58b8f081986aaf2a312d73a0a17985518b47fe6. It is recommended to upgrade the affected component.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CVulDB
3.05.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CVulDB
2.05.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
Open5GSn/a
  • 2.7.0Affected
  • 2.7.1Affected
  • 2.7.2Affected
  • 2.7.3Affected
  • 2.7.4Affected
  • 2.7.5Affected
  • 2.7.6Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.