CVE-2025-15555

A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. The manipulation of the argument OGS_KEY_LEN results in stack-based buffer overflow. The attack may be launched remotely. The patch is identified as 54dda041211098730221d0ae20a2f9f9173e7a21. A patch should be applied to remediate this issue.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/open5gs/open5gs/Product
• https://github.com/open5gs/open5gs/commit/54dda041211098730221d0ae20a2f9f9173e7a21Patch
• https://github.com/open5gs/open5gs/issues/4177Exploit, Issue Tracking, Third Party Advisory
• https://github.com/open5gs/open5gs/issues/4177#event-21256395700Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/submit/741901
• https://vuldb.com/vuln/343795
• https://vuldb.com/vuln/343795/cti
• https://github.com/open5gs/open5gs/issues/4177#event-21256395700Exploit, Issue Tracking, Third Party Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1555A vulnerability classified as critical was found in hzmanyun…9.8
• CVE-2025-15550birkir prime <= 0.4.0.beta.0 contains a cross-site request f…5.3
• CVE-2025-15551The response coming from TP-Link Archer MR200 v5.2, C20 v5 a…5.6
• CVE-2025-15552Insufficient Session Expiration in Truesec’s LAPSWebUI befor…7.8
• CVE-2025-15553Non-working logout functionality in Truesec’s LAPSWebUI befo…7.1
• CVE-2025-15554Browser caching of LAPS passwords in Truesec’s LAPSWebUI bef…7.8
• CVE-2025-15556Notepad++ versions prior to 8.8.9, when using the WinGUp upd…7.5
• CVE-2025-15557An Improper Certificate Validation vulnerability in TP-Link …8.8
• CVE-2025-15558Docker CLI for Windows searches for plugin binaries in C:\Pr…8
• CVE-2025-15559An unauthenticated attacker can inject OS commands when call…9.8
• CVE-2025-1556A vulnerability, which was classified as problematic, has be…9.8
• CVE-2025-15560An authenticated attacker with minimal permissions can explo…8.8