CVE-2025-25774
Published: 12 March 2025
Summary
CVE-2025-25774 is a medium-severity Insufficient Control Flow Management (CWE-691) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7684
Vulnerability details
An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and…
more
resulting in a Denial of Service (DoS).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in Open5GS AMF enables remote denial of service by crashing the service through malformed handover requests exploiting application state handling, facilitating Endpoint Denial of Service via application exploitation.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Design principles and implementation approaches enforce robust control-flow management to maintain function and enable recovery after disruption.