This vulnerability in Open5GS (up to version 2.7.7) involves the SMF component's function update_authorized_pcc_rule_and_qos, which can be remotely manipulated to trigger a denial of service condition. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation results in denial of service of the affected Open5GS SMF component, potentially disrupting service management functions. There is no indication of data confidentiality or integrity impact. The vulnerability can be exploited remotely with low complexity and minimal privileges, which could affect availability of the service.

No official patch or remediation is currently available from the vendor or project. Since the project has not responded and no fixes have been published, users should monitor vendor advisories for updates. Until a fix is released, consider applying network-level protections to restrict access to the SMF component and limit exposure to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.