CVE-2025-15529
Published: 16 January 2026
Summary
CVE-2025-15529 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2025-15529 is a denial-of-service vulnerability affecting Open5GS versions up to 2.7.6. The issue resides in the sgwc_s5c_handle_create_session_response function within the file src/sgwc/s5c-handler.c. It is classified under CWE-404 and has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity with low impact limited to availability.
The vulnerability enables remote attackers with no required privileges to exploit it over the network with low complexity. Successful exploitation triggers a denial of service, potentially disrupting service availability in affected Open5GS deployments. An exploit for this issue has been made public and could be used by adversaries.
Mitigation is available via a specific patch commit, b19cf6a2dbf5d30811be4488bf059c865bd7d1d2, published in the Open5GS GitHub repository. Security practitioners should deploy this patch to remediate the vulnerability, with further details documented in the associated GitHub issues and commit references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206295
Vulnerability details
A vulnerability was found in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been…
more
made public and could be used. The patch is named b19cf6a2dbf5d30811be4488bf059c865bd7d1d2. To fix this issue, it is recommended to deploy a patch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated DoS via application-specific flaw directly maps to application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch (commit b19cf6a2) that eliminates the sgwc_s5c_handle_create_session_response flaw.
Implements network-level DoS protections that can limit the availability impact of the unauthenticated remote trigger described in the CVE.
Requires robust error-handling routines that would mitigate the improper resource shutdown (CWE-404) root cause in the affected handler.