Open5GS SCTP Partial Message recv_handler assertion

published 2025-07-12 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21231

cvss: 3.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_recv_handler/s1ap_recv_handler/recv_handler of the component SCTP Partial Message Handler. The manipulation leads to reachable assertion. The attack needs to be approached locally. The patch is named cfa44575020f3fb045fd971358442053c8684d3d. It is recommended to apply a patch to fix this issue.

Patch / fix

fixed in 1 links 1

open5gs open5gs 2.7.6

github.com/open5gs/open5gs@cfa4457 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 15 mo ago (2025-07-14)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/open5gs/open5gs/issues/3878/ referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/open5gs/open5gs/issues/3878#issuecomment-2853775136 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	3.0	3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P

Affected products

n/a Open5GS

Classification

Weakness

CWE-617 Reachable Assertion

References

github.com /open5gs/open5gs/commit/cfa44575020f3fb045fd971358442053c8684d3d
patch
github.com /open5gs/open5gs/issues/3878/
issue-tracking, exploit, third-party-advisory
github.com /open5gs/open5gs/issues/3878#issuecomment-2853775136
issue-tracking, exploit
vuldb.com /?id.316135
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.316135
signature, permissions-required, third-party-advisory, vdb-entry
vuldb.com /?submit.610601
third-party-advisory, vdb-entry

Sources

CVE List CVE-2025-7485
NVD CVE-2025-7485

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary