CVE-2025-14954 is a vulnerability identified in Open5GS, an open-source 5G core network implementation widely used for mobile network infrastructure. The flaw exists in the PFCP (Packet Forwarding Control Protocol) context management functions: ogs_pfcp_pdr_find_or_add, ogs_pfcp_far_find_or_add, ogs_pfcp_urr_find_or_add, and ogs_pfcp_qer_find_or_add within the lib/pfcp/context.c source file. These functions handle the creation or retrieval of PDR (Packet Detection Rule), FAR (Forwarding Action Rule), URR (Usage Reporting Rule), and QER (QoS Enforcement Rule) entities, which are critical for managing user plane traffic in 5G networks. The vulnerability manifests as a reachable assertion failure triggered by crafted PFCP messages that manipulate these components, leading to an unexpected program state and likely causing a denial of service (DoS) by crashing or halting the affected process. The attack can be initiated remotely without authentication or user interaction, but the complexity is rated high due to the need for precise manipulation of PFCP messages. The CVSS 4.0 score is 6.3 (medium severity), reflecting the moderate impact on availability and the difficulty of exploitation. No known exploits have been observed in the wild, but the vulnerability has been publicly disclosed, and a patch identified by commit 442369dcd964f03d95429a6a01a57ed21f7779b7 is available to remediate the issue. This vulnerability primarily threatens the availability of 5G core network functions relying on Open5GS, potentially disrupting mobile service continuity.

For European organizations, particularly telecom operators and mobile service providers deploying Open5GS as part of their 5G core infrastructure, this vulnerability poses a risk of service disruption through denial of service attacks. The PFCP protocol is essential for user plane traffic management; thus, exploitation could interrupt data forwarding and degrade network performance or availability. This could impact end-users by causing dropped connections or degraded quality of service. Given the critical role of 5G networks in supporting essential services, IoT, and enterprise connectivity, even temporary outages could have significant operational and reputational consequences. Additionally, regulatory compliance frameworks in Europe emphasize network reliability and security, so failure to address this vulnerability could lead to compliance issues. While confidentiality and integrity impacts are minimal, the availability impact is significant enough to warrant urgent attention. The high complexity of exploitation somewhat reduces immediate risk but does not eliminate it, especially as attackers may develop more sophisticated methods over time.

The primary mitigation is to apply the official patch identified by commit 442369dcd964f03d95429a6a01a57ed21f7779b7 to all affected Open5GS versions (2.7.0 through 2.7.5). Network operators should ensure timely updates of their 5G core network components. Additionally, implementing strict PFCP message validation and anomaly detection can help identify and block malformed or suspicious PFCP traffic attempting to exploit this vulnerability. Deploying network segmentation and limiting exposure of PFCP interfaces to trusted network segments reduces the attack surface. Monitoring logs and network telemetry for unusual PFCP activity or assertion failures can provide early warning signs. Operators should also review their incident response plans to handle potential denial of service events affecting 5G core functions. Finally, engaging with Open5GS community updates and security advisories will help maintain awareness of emerging threats and patches.