CVE-2025-15686
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Open5GS up to 2.7.6, a vulnerability in the fd_msg_sess_get function of the HSS Service component leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could cause unavailability of HSS services, disrupting network operations.
Recommendation
Apply vendor patches or upgrade Open5GS to a version that addresses this vulnerability.
Original NVD description (English source)
A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation of the argument Session-Id leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project locked and limited conversation to collaborators.