CVE-2025-1925

A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

• CWE-404

• https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20PDU%20Session%20ID%20ConflictExploit, Third Party Advisory
• https://github.com/open5gs/open5gs/pull/3711Issue Tracking, Vendor Advisory
• https://vuldb.com/?ctiid.298513Permissions Required, VDB Entry
• https://vuldb.com/?id.298513Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.506038Third Party Advisory, VDB Entry

Published

Mar 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1919Out of bounds read in Media in Google Chrome prior to 134.0.…8.8
• CVE-2025-1920Type Confusion in V8 in Google Chrome prior to 134.0.6998.88…8.8
• CVE-2025-1921Inappropriate implementation in Media Stream in Google Chrom…6.5
• CVE-2025-1922Inappropriate implementation in Selection in Google Chrome o…4.3
• CVE-2025-1923Inappropriate implementation in Permission Prompts in Google…4.3
• CVE-2025-1924A vulnerability has been found in Vnet/IP Interface Package …8.2
• CVE-2025-1926The Page Builder: Pagelayer – Drag and Drop website builder …4.3
• CVE-2025-1927Cross-Site Request Forgery (CSRF) vulnerability in Restajet …7.1
• CVE-2025-1928Improper Restriction of Excessive Authentication Attempts vu…9.1
• CVE-2025-1929Improper Neutralization of Special Elements used in an SQL C…7.2
• CVE-2025-1930On Windows, a compromised content process could use bad Stre…8.8
• CVE-2025-1931It was possible to cause a use-after-free in the content pro…7.5