CVE-2025-15687 Overview
CVE-2025-15687 is a denial-of-service vulnerability in Open5GS, an open source implementation of 5G Core and EPC network functions. The flaw affects versions up to and including 2.7.6 and resides in the smf_gx_cca_cb function within the Session Management Function (SMF) Diameter Gx Credit-Control-Answer handler. Improper handling of unexpected Diameter response conditions causes the SMF process to crash, disrupting session management for 5G and LTE subscribers. The issue is tracked under [CWE-404: Improper Resource Shutdown or Release]. A public exploit has been released, and the maintainers fixed the flaw in Open5GS 2.7.7 via commit f23d7a5e959acd8f37b925dc29b85f26b7d391cb.
Critical Impact
Remote attackers with low privileges can crash the Open5GS SMF process, disrupting mobile core session management for all attached subscribers.
Affected Products
- Open5GS versions up to and including 2.7.6
- Open5GS SMF (Session Management Function) component
- Diameter Gx Credit-Control-Answer handler (smf_gx_cca_cb)
Discovery Timeline
- 2026-08-12 - CVE-2025-15687 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2025-15687
Vulnerability Analysis
The vulnerability affects the Diameter Gx interface implementation used by the Open5GS SMF to communicate with the Policy and Charging Rules Function (PCRF). Specifically, the smf_gx_cca_cb callback processes Credit-Control-Answer (CCA) messages returned by the PCRF. When the callback encounters malformed or unexpected Diameter response conditions, it fails to release resources or reject the message gracefully, resulting in a process crash. This maps to [CWE-404: Improper Resource Shutdown or Release]. Because the SMF is a central component of the 5G/EPC control plane, its termination interrupts PDU session establishment and modification for connected user equipment. The EPSS score of 0.612% reflects a modest but non-trivial exploitation probability at the 46th percentile.
Root Cause
The root cause is inadequate exception handling in Rx callbacks for Diameter Result-Code AVPs. Prior to the patch, the code did not account for result codes such as DIAMETER_UNABLE_TO_DELIVER (3002) and DIAMETER_OUT_OF_SPACE (4002), causing the SMF to hit unhandled paths and crash rather than fail closed on the specific session.
Attack Vector
An attacker positioned on the Diameter signaling path, or capable of influencing PCRF responses, can trigger the crash by causing a Credit-Control-Answer with an unexpected Result-Code to be delivered to the SMF. Low authenticated privileges are required, and no user interaction is needed. The impact is limited to availability of the SMF component.
#define OGS_DIAM_AVP_CODE_FRAME_IPV6_PREFIX 97
/* Result-Code AVP */
+#define OGS_DIAM_UNABLE_TO_DELIVER 3002
#define OGS_DIAM_UNKNOWN_PEER 3010
+#define OGS_DIAM_OUT_OF_SPACE 4002
#define OGS_DIAM_AVP_UNSUPPORTED 5001
#define OGS_DIAM_UNKNOWN_SESSION_ID 5002
#define OGS_DIAM_AUTHORIZATION_REJECTED 5003
// Source: https://github.com/open5gs/open5gs/commit/f23d7a5e959acd8f37b925dc29b85f26b7d391cb
// This patch introduces additional Diameter Result-Code constants so Rx callbacks
// can recognize and handle transport-layer failures without crashing.
Detection Methods for CVE-2025-15687
Indicators of Compromise
- Unexpected termination or repeated restarts of the Open5GS smf process on core network hosts.
- Diameter Gx CCA messages arriving at the SMF containing Result-Code values such as 3002 (UNABLE_TO_DELIVER) or 4002 (OUT_OF_SPACE) followed by SMF service loss.
- Presence of crash artifacts similar to those in the public reproducer archive SMF.crashes.zip attached to GitHub Issue #4027.
Detection Strategies
- Monitor Diameter Gx traffic between SMF and PCRF for anomalous Result-Code distributions, particularly non-2xxx codes preceding SMF outages.
- Alert on core-fault process supervisor events (systemd, Kubernetes liveness probes) restarting the open5gs-smfd service.
- Correlate PDU session establishment failures across gNBs with SMF availability metrics to identify signaling-driven denial of service.
Monitoring Recommendations
- Ingest Open5GS component logs and Diameter interface telemetry into a centralized analytics platform for retention and correlation.
- Track running version of Open5GS across all core network nodes and flag hosts still on 2.7.6 or earlier.
- Baseline normal CCA Result-Code frequencies so deviations can be alerted on in near real time.
How to Mitigate CVE-2025-15687
Immediate Actions Required
- Upgrade Open5GS to version 2.7.7 or later on all SMF nodes without delay.
- Verify the deployed binary includes commit f23d7a5e959acd8f37b925dc29b85f26b7d391cb if building from source.
- Restrict network reachability of the Diameter Gx interface to trusted PCRF peers using firewall rules and IPsec.
Patch Information
The fix is available in Open5GS release v2.7.7 and was merged via pull request #4034. The specific patch commit is f23d7a5, which enhances exception handling in all Diameter Rx callbacks. Additional context is available in VulDB CVE-2025-15687.
Workarounds
- Enforce strict Diameter peer authentication and TLS/IPsec on the Gx interface to prevent untrusted senders from injecting malformed CCAs.
- Deploy SMF instances behind a process supervisor that automatically restarts the service on crash to reduce outage duration.
- Segment the mobile core signaling network so only authorized PCRF endpoints can reach the SMF Diameter listener.
# Upgrade Open5GS from source to a patched version
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.7.7
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install
# Restart the SMF service after upgrade
sudo systemctl restart open5gs-smfd
sudo systemctl status open5gs-smfd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
