CVE-2025-6952 Open5GS AMF Service amf-sm.c amf_state_operational assertion

A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amfstateoperational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the loc...

PT-2025-27524 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.5 Description: A problematic issue has been found in Open5GS, affecting the amf state operational function of the file src/amf/amf-sm.c in the AMF Service component. This issue leads to a reachable assertion and can...

CVE-2025-6952: Reachable Assertion

A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amfstateoperational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the loc...

Open5GS Denial of Service Vulnerability (CNVD-2025-18575)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS suffers from a denial of service vulnerability that can be exploited by an attacker to cause a crash caused by the AMF in commonregisterstate...

PT-2025-24613 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function common register state of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ran ue id leads to denial of service. The attack...

CVE-2025-5935: Improper Resource Shutdown or Release

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function commonregisterstate of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ranueid leads to denial of service. The attack can be...

CVE-2025-5520 Open5GS AMF/MME emm_state_authentication assertion

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmmstateauthentication/emmstateauthentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has be...

CVE-2025-5520 Open5GS AMF/MME emm_state_authentication assertion

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmmstateauthentication/emmstateauthentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has be...

CVE-2025-5520: Reachable Assertion

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmmstateauthentication/emmstateauthentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has be...

Exploit for Classic Buffer Overflow in Free5Gc

CVE-2025-29632 the information for the vulnerability covered b...

CVE-2025-29632: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handlergenerated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components...

CVE-2025-29632

Free5gc version 4.0.0 and previous versions are vulnerable to a buffer overflow that allows a remote attacker to cause a denial of service (DoS) . The issue occurs because the AMF component fails to verify if the nASPDU content is empty when processing the InitialUEMessage ; it only checks for a ...

CVE-2025-29632

Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handlergenerated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components...

CVE-2024-34476

Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogsnasencrypt in lib/nas/common/security.c for pkbuf-len...

CVE-2024-34475

Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmmstateauthentication in amf/gmm-sm.c for != OGSERROR...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24447

A buffer overflow in the ngapamfhandlepdusessionresourcesetupresponse function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a PDU Session Resource Setup Response with an empty Response Item list...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24451

A stack overflow in the sctpserver::sctpreceiverthread component of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS by repeatedly establishing SCTP connections with the N2 interface...

CVE-2024-24443

An uninitialized pointer dereference in the ngaphandlepdusessionresourcesetupresponse routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted PDU Session Resource Setup Response...