CVE-2025-29646: open5gs · n/a
Affects open5gsSource CVE Database V5
Not known to be exploited · CVSS 7.1 High.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 18 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubopen5gs/open5gspkg:github/open5gs/open5gsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate this vulnerability, European organizations should: 1) Upgrade Open5GS to a version where this vulnerability is patched once available. 2) Implement strict network segmentation and access controls to restrict PFCP control plane traffic to trusted SMF nodes only, minimizing exposure to unauthorized entities. 3) Deploy deep packet inspection (DPI) or protocol-aware firewalls to detect and block malformed PFCP packets, especially those with suspicious TEID values or restoration indication flags. 4) Monitor UPF logs and network telemetry for abnormal PFCP session establishment requests or repeated failures that may indicate exploitation attempts. 5) Consider rate limiting PFCP requests and implementing anomaly detection systems to identify and mitigate potential DoS attacks early. 6) Engage with vendors and open-source communities to contribute to or expedite the development of patches and share threat intelligence. These steps go beyond generic advice by focusing on protocol-specific controls and proactive monitoring tailored to the nature of the vulnerability.
Description
An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_pool.size).