CVE-2025-15684: Open5GS CER Handler RCE Vulnerability

CVE-2025-15684 Overview

CVE-2025-15684 is a reachable assertion vulnerability in Open5GS versions up to and including 2.7.6. The flaw resides in the diam_log_func function within lib/diameter/common/init.c, part of the Capabilities-Exchange-Request (CER) Handler in the Diameter protocol stack. A remote, unauthenticated attacker can send a malformed CER message that triggers a fatal assertion and terminates the affected Open5GS process. The issue is tracked under [CWE-617: Reachable Assertion] and results in a denial-of-service condition against 5G core network functions. The Open5GS project addressed the vulnerability in release 2.7.7 with commit c1a803516a3c0485696cb9bcca7a80ad857c7383.

Critical Impact
A remote, unauthenticated attacker can crash Open5GS core network functions by sending a malformed Diameter CER message, disrupting 5G/LTE subscriber signaling.

Affected Products

Open5GS versions up to and including 2.7.6
Open5GS Diameter common library (lib/diameter/common/init.c)
Open5GS Diameter CER Handler component

Discovery Timeline

2026-08-12 - CVE-2025-15684 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-15684

Vulnerability Analysis

Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The Diameter protocol is used between network elements for authentication, authorization, and accounting exchanges. When a Diameter peer establishes a connection, it sends a Capabilities-Exchange-Request (CER) message that Open5GS parses through its freeDiameter-based logging and handler chain.

The vulnerability originates in diam_log_func, the callback that translates internal Diameter log events into Open5GS log entries. When the underlying library reports a FD_LOG_FATAL event during CER processing, the callback invokes ogs_assert_if_reached(). This assertion aborts the process instead of returning an error, so any malformed CER that reaches the fatal-log branch takes down the network function.

A public exploit is available, and the attack requires no authentication or user interaction. Successful exploitation causes loss of availability for the targeted MME, AMF, HSS, or other Open5GS component handling Diameter traffic.

Root Cause

The root cause is a reachable assertion in error-handling logic. Rather than returning a controlled failure when the Diameter stack signals a fatal log condition, diam_log_func calls ogs_assert_if_reached(), which aborts the process. Attacker-controlled input flowing through CER parsing is sufficient to reach this code path.

Attack Vector

The attack vector is network-based. An attacker with reachability to the Diameter listening port of an Open5GS instance sends a crafted CER message. The malformed content causes the freeDiameter engine to emit a fatal log entry, which triggers the assertion inside Open5GS and terminates the process. In multi-node deployments, repeated triggering prevents the service from staying online.

// Patch: lib/diameter/common/init.c
// Removes the fatal assert so malformed CER messages no longer crash the process
         break;
     case FD_LOG_FATAL:
         diam_log_printf(OGS_LOG_FATAL, "%s\n", buffer);
-        ogs_assert_if_reached();
         break;
     default:
         diam_log_printf(OGS_LOG_ERROR, "[%d] %s\n", printlevel, buffer);
// Source: https://github.com/open5gs/open5gs/commit/c1a803516a3c0485696cb9bcca7a80ad857c7383

Detection Methods for CVE-2025-15684

Indicators of Compromise

Unexpected termination of Open5GS network functions (MME, AMF, SGWC, SMF) with FD_LOG_FATAL entries preceding the crash.
Core dumps or systemd restart events for open5gs-* services correlated with inbound Diameter traffic.
Diameter CER messages from unexpected peers or with malformed AVPs on TCP/SCTP port 3868.

Detection Strategies

Monitor Open5GS logs for OGS_LOG_FATAL lines emitted from diam_log_func followed by process exit.
Alert on repeated service restarts of Open5GS Diameter-facing components within short time windows.
Inspect Diameter peer tables for connections from IP addresses not listed as approved network peers.

Monitoring Recommendations

Centralize Open5GS logs and Diameter peer connection events into a SIEM or data lake for correlation with process-termination signals.
Baseline normal CER message rates per peer and alert on deviations that coincide with service failures.
Enable packet capture on Diameter interfaces (S6a, S13, Cx) to support post-incident analysis of malformed CER payloads.

How to Mitigate CVE-2025-15684

Immediate Actions Required

Upgrade all Open5GS deployments to version 2.7.7 or later, which contains commit c1a803516a3c0485696cb9bcca7a80ad857c7383.
Restrict Diameter port exposure (default TCP/SCTP 3868) to trusted peer IP addresses using host or network firewalls.
Verify that Open5GS services are configured to restart automatically to reduce dwell time during exploitation attempts.

Patch Information

The fix is available in Open5GS release v2.7.7. The patch commit c1a8035 removes the ogs_assert_if_reached() call from the FD_LOG_FATAL branch of diam_log_func, allowing the process to continue after logging a fatal Diameter event. See GitHub Issue #4155 and the VulDB CVE-2025-15684 entry for additional context.

Workarounds

Apply strict IP allowlists on Diameter listeners so only known MME/HSS/PCRF peers can initiate CER exchanges.
Terminate Diameter traffic behind a Diameter Routing Agent (DRA) that validates CER structure before forwarding.
Deploy Open5GS network functions in redundant pairs so a single crash does not remove signaling capacity.

bash

# Upgrade example on Debian/Ubuntu-based systems
sudo systemctl stop open5gs-mmed open5gs-hssd open5gs-sgwcd open5gs-smfd

# Fetch and build v2.7.7 (or install the packaged 2.7.7 release)
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.7.7
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Restart services and verify version
sudo systemctl start open5gs-mmed open5gs-hssd open5gs-sgwcd open5gs-smfd
open5gs-mmed -v