CVE-2025-15687 Open5GS CVE debrief

Who should care

Defenders responsible for Open5GS installations should assess exposure and prioritize upgrading to version 2.7.7 if vulnerable. They should also review source-provided details for accurate affected scope and severity assessment, and monitor for remote attacks. This includes verifying the security of their Open5GS deployments, understanding the potential operational impacts, and taking appropriate measures to mitigate the vulnerability.

Why it matters

CVE-2025-15687 is a denial of service vulnerability in Open5GS up to 2.7.6. Defenders should verify exposure, prioritize upgrading to version 2.7.7, and monitor for remote attacks.

• Verify exposure of Open5GS installations
• Upgrade to version 2.7.7 if vulnerable
• Monitor for remote attacks and potential denial of service

Technical summary

The function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler in Open5GS up to 2.7.6 is vulnerable to denial of service. The attack can be launched remotely. Defenders should prioritize verifying exposure and upgrading to version 2.7.7 if vulnerable, while reviewing source-provided technical details for accurate impact assessment and potential mitigations. This vulnerability impacts Open5GS installations, specifically the SMF component, and its exploitation could lead to service disruption.

Defensive priority

Defenders should prioritize verifying exposure of Open5GS installations and upgrading to version 2.7.7 if vulnerable.

Recommended defensive actions

• Verify Open5GS installations for exposure
• Upgrade to version 2.7.7 if vulnerable
• Monitor for remote attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and source metadata indicate a denial of service vulnerability in Open5GS up to 2.7.6. The attack can be launched remotely. Upgrading to version 2.7.7 is recommended. Defenders should verify exposure and review source-provided details for accurate affected scope and severity assessment. Evidence limits suggest remote attack feasibility but require defensive validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.