CVE-2025-8801
Published: 10 August 2025
Summary
CVE-2025-8801 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 19.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability exists in Open5GS versions up to 2.7.5 within the AMF component, specifically in the gmm_state_exception function of src/amf/gmm-sm.c. The flaw, tracked as CWE-404, permits remote manipulation that results in denial of service and carries a CVSS 4.0 score of 5.5.
An unauthenticated attacker can exploit the issue over the network to disrupt AMF operation. Public disclosure of the exploit code means the attack is feasible for anyone with network access to an affected instance.
The Open5GS project addresses the vulnerability by releasing version 2.7.6, which incorporates the fix in commit f47f2bd4f7274295c5fbb19e2f806753d183d09a. Administrators are advised to upgrade the affected component promptly.
The EPSS score has remained flat at 0.0139 with no material rise after disclosure, and no confirmed in-the-wild exploitation has been reported beyond the public proof-of-concept.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24083
Vulnerability details
A vulnerability was found in Open5GS up to 2.7.5. This affects the function gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has…
more
been disclosed to the public and may be used. Upgrading to version 2.7.6 is able to address this issue. The identifier of the patch is f47f2bd4f7274295c5fbb19e2f806753d183d09a. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Contingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.
Mandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.
Requires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.
Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.