Home

Description

Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.

PUBLISHED Reserved 2025-04-16 | Published 2025-10-27 | Updated 2025-10-29 | Assigner INCIBE




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Problem types

CWE-617 Reachable Assertion

Product status

Default status
unaffected

Any version
affected

References

www.incibe.es/.../multiple-vulnerabilities-newplanes-open5gs

open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html patch

cve.org (CVE-2025-41067)

nvd.nist.gov (CVE-2025-41067)

Download JSON