CVE-2025-15555: Open5GS Buffer Overflow Vulnerability

CVE-2025-15555 Overview

CVE-2025-15555 is a stack-based buffer over-read vulnerability in Open5GS versions up to 2.7.6. The flaw resides in the hss_ogs_diam_cx_mar_cb function inside src/hss/hss-cx-path.c, part of the VoLTE Cx-Test component. The Home Subscriber Server (HSS) reads OGS_KEY_LEN bytes from the Anonymity Key (AK) buffer during debug hex-dump logging, exceeding the actual AK buffer length. Remote attackers can trigger the condition over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can induce a stack buffer over-read in the Open5GS HSS Cx interface, potentially leaking adjacent stack memory through debug logs.

Affected Products

Open5GS up to and including version 2.7.6
Open5GS HSS component (src/hss/hss-cx-path.c)
VoLTE Cx-Test Diameter interface handler

Discovery Timeline

2026-02-04 - CVE-2025-15555 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2025-15555

Vulnerability Analysis

The vulnerability is a stack-based memory boundary violation [CWE-119, CWE-787] within the Open5GS HSS Diameter Cx Multimedia-Auth-Request (MAR) callback. When the HSS processes a Cx-MAR request from the Call Session Control Function (CSCF), it computes authentication vectors including the Anonymity Key. During debug logging, the implementation hex-dumps the AK buffer using the incorrect length constant OGS_KEY_LEN rather than the proper OGS_AK_LEN. Because the AK is shorter than the integrity and ciphering keys, the hex-dump routine reads past the end of the AK allocation on the stack.

This over-read can expose adjacent stack contents through debug log output. In VoLTE deployments where HSS logs are aggregated or shipped to external collectors, this leakage broadens the exposure surface. The network attack vector means any peer capable of issuing Diameter Cx-MAR requests can trigger the condition.

Root Cause

The root cause is a length-constant mismatch. The ogs_log_hexdump call for the AK buffer used OGS_KEY_LEN (16 bytes), while the AK is defined as OGS_AK_LEN (6 bytes). The discrepancy causes the logger to read 10 bytes beyond the AK buffer boundary on every Cx-MAR transaction with debug logging active.

Attack Vector

The attack is launched remotely against the HSS Diameter Cx interface. An attacker with reachability to the Cx endpoint sends a crafted Multimedia-Auth-Request that drives execution into the affected code path. No authentication or user interaction is required. Exploitation requires that debug-level logging be enabled to surface the over-read data, though the memory access itself occurs regardless.

     ogs_log_print(OGS_LOG_DEBUG, "ik - ");
     ogs_log_hexdump(OGS_LOG_DEBUG, ik, OGS_KEY_LEN);
     ogs_log_print(OGS_LOG_DEBUG, "ak - ");
-    ogs_log_hexdump(OGS_LOG_DEBUG, ak, OGS_KEY_LEN);
+    ogs_log_hexdump(OGS_LOG_DEBUG, ak, OGS_AK_LEN);
     ogs_log_print(OGS_LOG_DEBUG, "xres - ");
     ogs_log_hexdump(OGS_LOG_DEBUG, xres, xres_len);
// Source: https://github.com/open5gs/open5gs/commit/54dda041211098730221d0ae20a2f9f9173e7a21

The patch replaces OGS_KEY_LEN with OGS_AK_LEN, restricting the hex-dump to the actual length of the Anonymity Key.

Detection Methods for CVE-2025-15555

Indicators of Compromise

Unusual volume of inbound Diameter Cx-MAR requests targeting the HSS from unexpected CSCF peers
HSS debug logs containing AK hex-dumps with high-entropy trailing bytes that do not match expected key material
Diameter session establishment from IP addresses outside the trusted IMS core network

Detection Strategies

Inspect HSS binary versions and confirm presence or absence of commit 54dda041211098730221d0ae20a2f9f9173e7a21
Monitor Diameter Cx interface traffic for malformed or anomalous MAR command codes
Audit log retention and forwarding policies to determine whether AK hex-dumps have been exported to downstream systems

Monitoring Recommendations

Enable network flow logging on the Cx interface and alert on Diameter peers not on an allowlist
Track HSS process logs for repeated Cx-MAR handler invocations correlated with unknown subscriber identities
Forward HSS telemetry into a centralized data lake for correlation across IMS core components

How to Mitigate CVE-2025-15555

Immediate Actions Required

Upgrade Open5GS to a build that includes commit 54dda041211098730221d0ae20a2f9f9173e7a21
Disable debug-level logging on production HSS instances until the patch is applied
Restrict Diameter Cx interface reachability to authenticated, allowlisted CSCF peers via firewall or IPsec policy

Patch Information

The fix is committed upstream in the Open5GS repository. See the GitHub Commit 54dda041 and the corresponding tracking issue at GitHub Issue #4177. Operators should rebuild from a tagged release that incorporates this commit and redeploy the HSS component.

Workarounds

Lower HSS log level below OGS_LOG_DEBUG to suppress the hex-dump call path that surfaces leaked data
Segment the Cx Diameter interface onto a dedicated VLAN reachable only by trusted IMS elements
Rotate any subscriber authentication material that may have transited debug logs exported to third-party log stores

bash

# Verify installed Open5GS version and confirm patched commit
open5gs-hssd -v
cd /path/to/open5gs
git log --oneline | grep 54dda041

# Build patched release
git fetch --tags
git checkout v2.7.7
meson build --prefix=`pwd`/install
ninja -C build install