CVE-2025-66786

High

Published: 07 January 2026

Published

07 January 2026

Modified

29 January 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0029 53.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-66786 is a high-severity Improper Input Validation (CWE-20) vulnerability in Openairinterface Oai-Cn5G-Amf. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-66786 is a vulnerability in OpenAirInterface CN5G AMF versions up to and including v2.0.1, stemming from a logical error in processing JSON format requests. This flaw, classified under CWE-20 (Improper Input Validation), affects the AMF's Service-Based Interface (SBI) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Unauthorized remote attackers can exploit this vulnerability by sending malicious JSON data to the AMF's SBI interface, triggering a denial-of-service condition without requiring authentication or user interaction. Successful exploitation disrupts service availability, potentially halting core network functions in affected 5G deployments.

For mitigation details, refer to the advisory at https://github.com/swallele/Vulnerability/blob/main/Openairinterface/Dos/Json_Dos.md.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-1212

Vulnerability details

OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack.

CWE(s): CWE-20

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Vulnerability enables remote unauthenticated DoS via malformed JSON on exposed SBI (public-facing 5G AMF), directly matching public app exploitation for initial access and application/system exploitation for endpoint DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1