CVE-2025-15176CWE-617

CVE-2025-15176

Medium · published December 29, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00618 · 48.9th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2025-12-29T12:15Z
Affected products (1)
ProductVersionsFixed in
open5gs/open5gs≤ 2.7.5—
References (8)
https://github.com/open5gs/open5gs/ · [email protected]https://github.com/open5gs/open5gs/commit/b72d8349980076e2c033c8324f07747a86eea4f8 · [email protected]https://github.com/open5gs/open5gs/issues/4180 · [email protected]https://github.com/open5gs/open5gs/issues/4180#issue-3666760066 · [email protected]https://github.com/open5gs/open5gs/issues/4180#issuecomment-3615555671 · [email protected]https://vuldb.com/?ctiid.338561 · [email protected]https://vuldb.com/?id.338561 · [email protected]https://vuldb.com/?submit.719830 · [email protected]
EPSS history
Timeline
  • 29 DEC 06:32Z
    Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertion
    cvelistv5