CVE-2025-9405 Details
Description
A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The patch is identified as 8e5fed16114f2f5e40bee1b161914b592b2b7b8f. Applying a patch is advised to resolve this issue.
A denial-of-service vulnerability exists in Open5GS versions through 2.7.5, specifically within the AMF component. The issue arises in the 'gmm_state_exception' function of 'src/amf/gmm-sm.c', where late responses from the nudm-uecm service are not handled properly. Under certain conditions, such as strict memory constraints, the AMF may receive delayed HTTP/2 responses after the corresponding user equipment (UE) context has already been removed. This late response causes the AMF's state machine to encounter an unhandled situation, leading to a fatal assertion failure and crashing the AMF process. As a result, all connected UEs experience service disruption, impacting normal 5G core network operations. The vulnerability can be exploited remotely, without any authentication, by creating conditions that delay SBI responses or by causing rapid UE deregistration.
Users are advised to update to Open5GS version 2.7.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open5gs/open5gs/issues/3947 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/open5gs/open5gs/issues/3947#issuecomment-3029992728 | CISA-ADP | Issue Tracking |
| https://vuldb.com/?submit.633467 | CISA-ADP | Third Party AdvisoryVDB Entry |
| https://github.com/open5gs/open5gs/commit/8e5fed16114f2f5e40bee1b161914b592b2b7b8f | [email protected] | Patch |
| https://github.com/open5gs/open5gs/issues/3947 | [email protected] | ExploitIssue Tracking |
| https://github.com/open5gs/open5gs/issues/3947#issuecomment-3029992728 | [email protected] | Issue Tracking |
| https://github.com/user-attachments/files/21013084/amf_udm-uecm.zip | [email protected] | Product |
| https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-9405 | [email protected] | Third Party Advisory |
| https://vuldb.com/?ctiid.321241 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.321241 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.633467 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open5gs open5gs | < 2.7.6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2025 | Initial Analysis | [email protected] |
| Aug 31, 2025 | CVE Modified | [email protected] |
| Aug 25, 2025 | CVE Modified | CISA-ADP |
| Aug 25, 2025 | New CVE Received | [email protected] |