This vulnerability affects Open5GS up to version 2.7.7 in the UDR component's ogs_dbi_subscription_data function. Manipulating the supi_id argument can cause a denial of service condition. The attack vector is network-based, requiring no user interaction and low privileges. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. The project has been notified but has not provided a fix or official guidance as of the publication date. No cloud service is involved, and no known exploits are reported in the wild.

Successful exploitation results in denial of service, potentially disrupting the availability of the affected Open5GS UDR component. This could impact network functions relying on subscription data retrieval. The vulnerability does not require user interaction or high privileges, increasing its risk. However, no evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Open5GS project has not responded or released a fix, users should monitor official channels for updates. In the interim, consider limiting network exposure of the affected component and applying any available access controls to reduce attack surface.