CVE-2025-15686 Overview
CVE-2025-15686 is a denial-of-service vulnerability in Open5GS versions up to 2.7.6. The flaw resides in the fd_msg_sess_get function within the Home Subscriber Server (HSS) service. Manipulation of the Session-Id argument in a Diameter message causes the HSS component to enter an error state, disrupting subscriber authentication and mobility management. The vulnerability is classified under CWE-404: Improper Resource Shutdown or Release. A proof-of-concept packet capture has been published, and the issue can be triggered remotely by an authenticated peer with low privileges.
Critical Impact
Remote attackers with low privileges can disrupt the HSS service, degrading availability of subscriber authentication in 4G/5G core networks running Open5GS.
Affected Products
- Open5GS versions up to and including 2.7.6
- Home Subscriber Server (HSS) component
- Deployments relying on the Diameter S6a interface handled by fd_msg_sess_get
Discovery Timeline
- 2026-08-12 - CVE-2025-15686 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2025-15686
Vulnerability Analysis
Open5GS is an open-source implementation of a 5G Core and EPC network. The HSS component processes Diameter protocol messages, including Update Location Requests (ULR) over the S6a interface. The vulnerability affects the fd_msg_sess_get function, which retrieves the session associated with an inbound Diameter message using the Session-Id attribute-value pair.
When the Session-Id argument is manipulated in an unexpected form, the function fails to properly release or handle the session resource. This produces an error condition inside the HSS service and results in a denial-of-service state. The referenced GitHub Issue #4190 documents the fault path with a reproducer.
Root Cause
The root cause is improper resource shutdown or release (CWE-404) triggered by malformed Session-Id handling in fd_msg_sess_get. The HSS does not gracefully recover from the error condition raised during ULR processing, leaving the service in a degraded or unavailable state.
Attack Vector
The attack originates from a network peer that can send Diameter messages to the HSS. The attacker requires low privileges, consistent with a peer already authorized to establish a Diameter connection to the S6a interface. No user interaction is required. A public proof-of-concept packet capture demonstrates the fault trigger by sending a crafted ULR with a manipulated Session-Id.
No verified exploitation code beyond the packet capture PoC is available. Refer to the Open5GS repository and VulDB entry for CVE-2025-15686 for additional technical context.
Detection Methods for CVE-2025-15686
Indicators of Compromise
- HSS process crash, restart, or unresponsive state following inbound Diameter ULR traffic
- Malformed or unusually structured Session-Id AVP values in Diameter messages captured on the S6a interface
- Repeated Diameter session errors logged by the HSS during subscriber location updates
Detection Strategies
- Enable verbose Diameter message logging on Open5GS HSS and alert on repeated fd_msg_sess_get errors
- Inspect S6a interface traffic with a network analyzer or IDS rule matching malformed Session-Id patterns
- Correlate HSS service restarts with recent inbound Diameter traffic from specific MME or peer endpoints
Monitoring Recommendations
- Continuously monitor HSS process health and Diameter transaction success rates
- Track authentication and location-update failure rates as leading indicators of HSS impairment
- Baseline Session-Id structures from trusted peers and alert on deviations
How to Mitigate CVE-2025-15686
Immediate Actions Required
- Restrict Diameter S6a peer connectivity to known, trusted MME endpoints using IPsec or firewall ACLs
- Monitor the Open5GS repository and Issue #4190 for the fix commit and updated release
- Increase HSS process supervision to auto-restart the service on failure while a patched build is prepared
Patch Information
At the time of publication, the upstream Open5GS project has not published a tagged release resolving CVE-2025-15686. The project locked and limited conversation on the referenced issue to collaborators. Operators should track GitHub Issue #4190 and apply the fix once merged upstream, then rebuild and redeploy the HSS component.
Workarounds
- Isolate the HSS management and S6a interfaces on segmented networks accessible only to authorized signaling peers
- Deploy a Diameter Edge Agent or signaling firewall to validate Session-Id formatting before messages reach the HSS
- Enforce process-level watchdogs or systemd restart policies to reduce downtime from repeated crashes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
