CVE-2025-5501 json
Open5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertion
published 2025-06-03 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16728
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_switch_request_transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2daa44adab762c47a8cef69cc984946973a845b3. It is recommended to apply a patch to fix this issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/open5gs/open5gs/issues/3909 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/user-attachments/files/20362183/AMF.crash.due.to.pathswitchrequest.zip referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- n/a Open5GS
Classification
- Weakness
-
- CWE-617 Reachable Assertion
References
-
github.com
/open5gs/open5gs/commit/2daa44adab762c47a8cef69cc984946973a845b3
patch
-
github.com
/open5gs/open5gs/issues/3909
issue-tracking, exploit, vendor-advisory
-
github.com
/user-attachments/files/20362183/AMF.crash.due.to.pathswitchrequest.zip
exploit, not-applicable
-
github.com
/open5gs/open5gs/issues/3909#issuecomment-2926682623
issue-tracking, vendor-advisory
-
vuldb.com
/?id.310915
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.310915
signature, permissions-required, vdb-entry
-
vuldb.com
/?submit.582265
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2025-5501
- NVD CVE-2025-5501
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.