CVE-2025-70123 is a vulnerability identified in free5GC version 4.0.1, an open-source 5G core network implementation. The flaw arises from improper input validation and non-compliance with the 3GPP TS 29.244 protocol in the User Plane Function (UPF) component. Specifically, the UPF incorrectly accepts a malformed PFCP (Packet Forwarding Control Protocol) Association Setup Request. According to the 3GPP standard, such malformed requests should be rejected to maintain protocol integrity. However, due to this improper handling, the UPF transitions into an inconsistent internal state. When a subsequent valid PFCP Session Establishment Request is received, this inconsistent state causes a cascading failure that disrupts the connection with the Session Management Function (SMF). The disruption results in denial of service conditions and service degradation within the 5G core network. The vulnerability is remotely exploitable without requiring any privileges or user interaction, making it a critical concern for network operators. The CVSS v3.1 base score is 7.5, reflecting high severity primarily due to the impact on availability. No patches or known exploits have been reported at the time of publication, but the vulnerability highlights the importance of strict protocol compliance and robust input validation in 5G core network components.

The primary impact of CVE-2025-70123 is a denial of service condition within 5G core networks utilizing free5GC v4.0.1. By causing the UPF to enter an inconsistent state and disrupting the SMF connection, attackers can degrade or interrupt critical 5G services. This can affect mobile network operators, enterprises, and service providers relying on free5GC for their 5G infrastructure. The disruption may lead to loss of connectivity for end-users, impacting voice, data, and IoT services. Given the central role of UPF and SMF in session management and data forwarding, the vulnerability could cause widespread service outages or degraded network performance. The remote, unauthenticated nature of the exploit increases the risk of exploitation by malicious actors, including nation-state or cybercriminal groups targeting telecommunications infrastructure. The lack of known exploits currently limits immediate risk, but the potential for future exploitation remains significant, especially as 5G adoption grows globally.

To mitigate CVE-2025-70123, organizations should: 1) Monitor free5GC project updates closely and apply patches or updates as soon as they become available addressing this vulnerability. 2) Implement strict network-level filtering to restrict access to PFCP ports (typically UDP 8805) to trusted management and control plane entities only, reducing exposure to malformed requests from untrusted sources. 3) Deploy anomaly detection systems capable of identifying malformed PFCP messages or unusual protocol behavior to enable early detection of exploitation attempts. 4) Conduct thorough protocol compliance testing and fuzzing on PFCP message handling within their 5G core deployments to identify and remediate similar input validation issues proactively. 5) Consider network segmentation and redundancy strategies to isolate UPF components and maintain service continuity in case of failure. 6) Engage with free5GC community and vendors for guidance and best practices on secure deployment and hardening of 5G core network functions. These measures go beyond generic advice by focusing on protocol-specific controls, network architecture, and proactive detection tailored to the vulnerability's nature.