CVE-2025-5520: Open5GS RCE Vulnerability in AMF/MME

CVE-2025-5520 Overview

CVE-2025-5520 is a reachable assertion vulnerability in Open5GS versions up to 2.7.3. The flaw resides in the gmm_state_authentication and emm_state_authentication functions within the Access and Mobility Management Function (AMF) and Mobility Management Entity (MME) components. An attacker can trigger the assertion remotely without authentication, causing the AMF or MME process to abort. This produces a denial of service condition affecting 4G LTE and 5G core network signaling. The issue was patched in commit 9f5d133657850e6167231527514ee1364d37a884. It is distinct from the previously reported CVE-2025-1893.

Critical Impact
Remote unauthenticated attackers can crash the AMF/MME process by triggering a reachable assertion during UE authentication state handling, disrupting mobile core signaling.

Affected Products

Open5GS versions up to and including 2.7.3
Open5GS AMF component (5G core)
Open5GS MME component (4G/LTE core)

Discovery Timeline

2025-06-03 - CVE-2025-5520 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5520

Vulnerability Analysis

The vulnerability is a reachable assertion classified under [CWE-617]. Open5GS uses the ogs_assert() macro extensively to enforce invariants during User Equipment (UE) state transitions. In the authentication state handlers gmm_state_authentication (AMF, 5G NAS) and emm_state_authentication (MME, EPS NAS), the code asserts that a corresponding RAN UE or eNB UE context exists. When a UE context is deleted concurrently, for example during a problematic handover-required process, the lookup returns NULL and the assertion fires. The ogs_assert() call terminates the process, dropping signaling for all subscribers attached to that AMF or MME instance.

Root Cause

The root cause is improper handling of a deleted UE context during NAS authentication message processing. The code invoked ran_ue_find_by_id() or enb_ue_find_by_id() and immediately asserted on the return value instead of gracefully handling a NULL result. Because the UE context lifecycle is driven by asynchronous events on the radio interface, a lookup miss is a valid runtime condition, not a programming invariant. Treating it as an assertion converts a recoverable state into a fatal process abort.

Attack Vector

The vulnerability is reachable over the network from any endpoint able to send NAS messages through an attached gNB or eNB, or by simulating handover-required signaling. No authentication or user interaction is required. A public proof of concept describing a problematic handover-required flow is referenced in GitHub Issue #3910.

// Patch excerpt from src/mme/emm-sm.c
// Source: https://github.com/open5gs/open5gs/commit/9f5d133657850e6167231527514ee1364d37a884
        ogs_assert(message);

        enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
-        ogs_assert(enb_ue);
+        if (!enb_ue) {
+            ogs_error("No S1 Context IMSI[%s] NAS-Type[%d] "
+                    "ENB-UE-ID[%d:%d][%p:%p]",
+                    mme_ue->imsi_bcd, message->emm.h.message_type,
+                    e->enb_ue_id, mme_ue->enb_ue_id,
+                    enb_ue_find_by_id(e->enb_ue_id),
+                    enb_ue_find_by_id(mme_ue->enb_ue_id));
+            ogs_assert(e->pkbuf);
+            ogs_log_hexdump(OGS_LOG_ERROR, e->pkbuf->data, e->pkbuf->len);
+            break;
+        }

The patch replaces the fatal ogs_assert(enb_ue) with a NULL check that logs the missing context and returns without crashing. An equivalent change was applied to src/amf/gmm-sm.c for the AMF path.

Detection Methods for CVE-2025-5520

Indicators of Compromise

Unexpected termination of the open5gs-amfd or open5gs-mmed process, followed by systemd or supervisor-driven restarts.
Assertion-related entries in Open5GS logs referencing gmm-sm.c or emm-sm.c and the authentication state.
Bursts of NAS authentication messages correlated with missing RAN UE or eNB UE context lookups.
Repeated UE detach or handover-required signaling from a single gNB/eNB peer preceding a crash.

Detection Strategies

Monitor process uptime for open5gs-amfd and open5gs-mmed and alert on abnormal restart frequency.
Parse Open5GS logs for ogs_error("No NG Context" and ogs_error("No S1 Context" messages introduced by the patch, which indicate exploitation attempts on patched systems.
Correlate SCTP/NGAP or S1AP flows for anomalous handover-required sequences from untrusted RAN peers.

Monitoring Recommendations

Ingest AMF/MME logs into a centralized log platform and build alerts on process abort signatures.
Track signaling plane metrics such as NAS authentication failure rate and UE context deletion rate.
Enforce peer allow-lists on the N2 and S1-MME interfaces to restrict which gNBs/eNBs can initiate signaling.

How to Mitigate CVE-2025-5520

Immediate Actions Required

Upgrade Open5GS to a version containing commit 9f5d133657850e6167231527514ee1364d37a884 or later.
Restrict network access to the N2 (NGAP) and S1-MME interfaces to trusted RAN nodes using firewall rules or IPsec.
Enable process supervision so that open5gs-amfd and open5gs-mmed restart automatically after an abort.

Patch Information

The fix is available in the upstream Open5GS repository as commit 9f5d133657850e6167231527514ee1364d37a884, titled "[AMF/MME] Prevent AMF/MME crash when UE context is deleted (#3910)." The patch modifies src/amf/gmm-sm.c and src/mme/emm-sm.c to replace fatal assertions with graceful NULL checks and error logging. Refer to the Open5GS Security Patch Commit for the complete diff.

Workarounds

Deploy the AMF and MME behind SCTP-aware access control lists that permit only authorized RAN peers.
Use IPsec on N2 and S1-MME interfaces as recommended by 3GPP to prevent untrusted signaling injection.
Run redundant AMF/MME instances behind load balancing so that a single process abort does not disrupt all subscribers.

bash

# Example: restrict S1-MME (SCTP/36412) and N2 (SCTP/38412) to known RAN peers
iptables -A INPUT -p sctp --dport 36412 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
iptables -A INPUT -p sctp --dport 38412 -j DROP

# Ensure systemd restarts the process after an assertion abort
sudo systemctl edit open5gs-amfd
# [Service]
# Restart=always
# RestartSec=2