CVE-2025-9405 is a security vulnerability identified in Open5GS versions 2.7.0 through 2.7.5, specifically within the function gmm_state_exception located in the source file src/amf/gmm-sm.c. Open5GS is an open-source implementation of the 5G core network, widely used for mobile network infrastructure. The vulnerability manifests as a reachable assertion failure, which means that under certain crafted inputs or network conditions, the program encounters an assertion that triggers unexpectedly during execution. This can cause the affected process to terminate abruptly or behave unpredictably. The vulnerability is remotely exploitable without any authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/AT:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P). The exploitability is rated as partially functional (E:P), and the vulnerability impacts availability (VA:L) by potentially causing denial of service through process crashes. No impact on confidentiality, integrity, or system control is noted. The vulnerability was publicly disclosed on August 25, 2025, and a patch has been released (commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f) to address the issue. Although no known exploits are currently observed in the wild, the public availability of the exploit code increases the risk of exploitation. This vulnerability is significant because Open5GS is used by mobile network operators and private 5G deployments, and a denial of service in the Access and Mobility Management Function (AMF) component could disrupt network availability and degrade service quality for subscribers.

For European organizations, especially telecom operators and enterprises deploying private 5G networks, this vulnerability poses a risk of service disruption. The AMF is a critical component responsible for managing user equipment registration, mobility, and session management. An assertion failure causing AMF crashes can lead to denial of service, interrupting mobile connectivity for end users. This can affect consumer mobile services, enterprise IoT operations, and critical infrastructure relying on 5G connectivity. The impact is particularly relevant for organizations that rely on Open5GS as part of their 5G core network infrastructure, including research institutions, private network operators, and emerging 5G service providers in Europe. Disruptions could lead to operational downtime, loss of customer trust, and potential regulatory scrutiny under EU telecom regulations and the NIS Directive. While the vulnerability does not directly compromise data confidentiality or integrity, the availability impact alone can have cascading effects on business continuity and critical communications.

European organizations should prioritize applying the official patch identified by commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f to all affected Open5GS deployments immediately. Network administrators should audit their Open5GS versions to confirm if they are running vulnerable releases (2.7.0 to 2.7.5) and upgrade to patched versions. Additionally, implementing robust network segmentation and firewall rules to restrict access to the AMF interfaces can reduce exposure to remote exploitation. Monitoring and alerting on AMF process crashes or abnormal behavior can provide early detection of exploitation attempts. Organizations should also consider deploying redundancy and failover mechanisms for the AMF to maintain service availability in case of crashes. Finally, maintaining up-to-date incident response plans tailored to telecom infrastructure will help mitigate operational impacts if exploitation occurs.