This vulnerability in Open5GS up to version 2.7.6 involves improper handling of the Session-Id argument in the fd_msg_sess_get function of the HSS Service component. An attacker can remotely manipulate this argument to trigger a denial of service condition, disrupting service availability. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although exploit code has been publicly disclosed, there is no vendor advisory or patch information available at this time.

Successful exploitation results in denial of service, impacting the availability of the Open5GS HSS Service. The attack can be performed remotely without authentication or user interaction, potentially causing service disruption to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections to restrict access to the vulnerable service and monitor for unusual Session-Id manipulations if possible.