CVE-2025-15684

Deferred Deferred - Pending Action

Reachable Assertion in Open5GS Diameter CER Handler

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: VulDB

Description

A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.7.7 is able to address this issue. The patch is identified as c1a803516a3c0485696cb9bcca7a80ad857c7383. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2025-15684

EUVD

EUVD-2025-210701

Affected Vendors & Products

Vendor	Product	Version / Range
open5gs	open5gs	to 2.7.6 (inc)
open5gs	open5gs	2.7.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

CVE-2025-15684 is a vulnerability in Open5GS versions up to 2.7.6 affecting the Diameter protocol handling in the CER Handler. A malformed Diameter Capabilities-Exchange-Request (CER) message with duplicate Auth-Application-Id AVPs triggers a fatal error in the freeDiameter parser. This causes an unimplemented code path to execute, leading to an abort() call that crashes the affected Open5GS daemons (HSS, MME, PCRF, AAA). The issue is remotely exploitable without authentication.

Detection Guidance

Monitor Open5GS daemons (HSS, MME, PCRF, AAA) for crashes when processing Diameter CER messages. Check logs for SIGABRT signals or assertions related to freeDiameter parser errors. Use network traffic analysis tools like tcpdump or Wireshark to inspect Diameter protocol messages on port 3868 for malformed CER packets with duplicate Auth-Application-Id AVPs.

Impact Analysis

This vulnerability can cause denial-of-service (DoS) conditions by crashing Open5GS network functions. Attackers can send a single malformed CER packet to any Diameter listener (typically port 3868) to terminate services like HSS, MME, PCRF, or AAA. This disrupts core network operations, leading to service unavailability for mobile subscribers.

Compliance Impact

This vulnerability causes denial-of-service conditions by crashing Open5GS daemons (HSS, MME, PCRF, AAA) when processing malformed Diameter messages. Such disruptions could lead to unauthorized data access or service unavailability, potentially violating GDPR's availability principle or HIPAA's access controls if critical healthcare or personal data processing is interrupted.

Mitigation Strategies

Upgrade Open5GS to version 2.7.7 or later to apply the patch that removes the fatal assertion. Block or filter malformed Diameter CER messages at the network perimeter using firewalls or intrusion prevention systems. Restart affected Open5GS daemons after upgrade to ensure the fix is active.

Hi! I’m here to help you understand CVE-2025-15684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70