CVE-2025-5520

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 9f5d133657850e6167231527514ee1364d37a884. It is recommended to apply a patch to fix this issue. This is a different issue than CVE-2025-1893.

• CWE-617

• https://github.com/open5gs/open5gs/commit/9f5d133657850e6167231527514ee1364d37a884Patch
• https://github.com/open5gs/open5gs/issues/3910Exploit, Issue Tracking
• https://github.com/open5gs/open5gs/issues/3910#issuecomment-2926719317Exploit, Issue Tracking
• https://github.com/user-attachments/files/20362243/Problematic.handover.required.process.zipExploit
• https://vuldb.com/?ctiid.310956Permissions Required, VDB Entry
• https://vuldb.com/?id.310956Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.582269Third Party Advisory, VDB Entry
• https://github.com/open5gs/open5gs/issues/3910Exploit, Issue Tracking

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55194Part-DB is an open source inventory management system for el…5.7
• CVE-2025-55195@std/toml is the Deno Standard Library. Prior to version 1.0…7.3
• CVE-2025-55196External Secrets Operator is a Kubernetes operator that inte…7.1
• CVE-2025-55197pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2025-55198Helm is a package manager for Charts for Kubernetes. Prior t…6.5
• CVE-2025-55199Helm is a package manager for Charts for Kubernetes. Prior t…6.5
• CVE-2025-55200BigBlueButton is an open-source virtual classroom. In versio…5.4
• CVE-2025-55201Copier library and CLI app for rendering project templates. …8.5
• CVE-2025-55202Opencast is a free, open-source platform to support the mana…5.3
• CVE-2025-55203Plane is open-source project management software. Prior to v…5.4
• CVE-2025-55204muffon is a cross-platform music streaming client for deskto…9.6
• CVE-2025-55205Capsule is a multi-tenancy and policy-based framework for Ku…9