CVE-2025-8804

Katalog CVE

CVSS 7.5 · High EPSS 0,82%

Kerentanan Reachable Assertion pada open5gs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ngap_build_downlink_nas_transport of the component AMF. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.7.6 is able to address this issue. The identifier of the patch is bca0a7b6e01d254f4223b83831162566d4626428. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

10 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-617: Reachable Assertion

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open5gs/open5gs/commit/bca0a7b6e01d254f4223b83831162566d4626428 patch
• https://vuldb.com/?id.319333 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.626124 advisory pihak ketiga · vdb entry
• https://github.com/user-attachments/files/21030801/newdata_for_ngap.zip exploit
• https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-8804
• https://github.com/open5gs/open5gs/issues/3950 issue tracking
• https://github.com/open5gs/open5gs/issues/3950#issuecomment-3034693457 issue tracking
• https://github.com/open5gs/open5gs/releases/tag/v2.7.6 release notes
• https://vuldb.com/?ctiid.319333 permissions required · vdb entry
• https://vuldb.com/?submit.625698