This vulnerability in Open5GS (up to version 2.7.7) involves improper handling of the target-plmn-list argument within the ogs_sbi_discovery_option_parse_plmn_list function of the NRF component's /lib/sbi/conv.c library. Exploiting this flaw allows a remote attacker to trigger a denial of service condition. The issue was reported early to the project but remains unaddressed, and no official remediation or patch has been published. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Successful exploitation results in denial of service of the Open5GS NRF component, potentially disrupting network function reliant on this service. The attack can be executed remotely without authentication or user interaction. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, organizations should monitor for updates from the Open5GS project. In the meantime, consider implementing network-level protections to limit exposure of the NRF service to untrusted sources.