CVE-2025-15687

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15687", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-09T17:50:46.986Z", "datePublished": "2026-08-12T02:45:10.502Z", "dateUpdated": "2026-08-12T12:35:38.910Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-12T02:45:10.502Z"}, "title": "Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "Open5GS", "versions": [{"version": "2.7.0", "status": "affected"}, {"version": "2.7.1", "status": "affected"}, {"version": "2.7.2", "status": "affected"}, {"version": "2.7.3", "status": "affected"}, {"version": "2.7.4", "status": "affected"}, {"version": "2.7.5", "status": "affected"}, {"version": "2.7.6", "status": "affected"}, {"version": "2.7.7", "status": "unaffected"}], "cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "modules": ["SMF Diameter Gx Credit-Control-Answer Handler"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-09T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-09T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-09T19:55:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "WeiYi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/387283", "name": "VDB-387283 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387283/cti", "name": "VDB-387283 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-15687", "name": "CVE-2025-15687 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/867119", "name": "Submit #867119 | Open5GS v2.7.5 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open5gs/open5gs/issues/4027", "tags": ["issue-tracking"]}, {"url": "https://github.com/open5gs/open5gs/pull/4034", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/21515527/SMF.crashes.zip", "tags": ["exploit"]}, {"url": "https://github.com/open5gs/open5gs/commit/f23d7a5e959acd8f37b925dc29b85f26b7d391cb", "tags": ["patch"]}, {"url": "https://github.com/open5gs/open5gs/releases/tag/v2.7.7", "tags": ["patch"]}, {"url": "https://github.com/open5gs/open5gs/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T12:35:16.345281Z", "id": "CVE-2025-15687", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:35:38.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15687", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T12:35:16.345281Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:35:35.983Z"}}], "cna": {"tags": ["x_open-source"], "title": "Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service", "credits": [{"lang": "en", "type": "reporter", "value": "WeiYi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["SMF Diameter Gx Credit-Control-Answer Handler"], "product": "Open5GS", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.3"}, {"status": "affected", "version": "2.7.4"}, {"status": "affected", "version": "2.7.5"}, {"status": "affected", "version": "2.7.6"}, {"status": "unaffected", "version": "2.7.7"}]}], "timeline": [{"lang": "en", "time": "2026-08-09T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-09T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-09T19:55:54.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/387283", "name": "VDB-387283 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387283/cti", "name": "VDB-387283 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-15687", "name": "CVE-2025-15687 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/867119", "name": "Submit #867119 | Open5GS v2.7.5 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open5gs/open5gs/issues/4027", "tags": ["issue-tracking"]}, {"url": "https://github.com/open5gs/open5gs/pull/4034", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/21515527/SMF.crashes.zip", "tags": ["exploit"]}, {"url": "https://github.com/open5gs/open5gs/commit/f23d7a5e959acd8f37b925dc29b85f26b7d391cb", "tags": ["patch"]}, {"url": "https://github.com/open5gs/open5gs/releases/tag/v2.7.7", "tags": ["patch"]}, {"url": "https://github.com/open5gs/open5gs/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-12T02:45:10.502Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15687", "state": "PUBLISHED", "dateUpdated": "2026-08-12T12:35:38.910Z", "dateReserved": "2026-08-09T17:50:46.986Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-12T02:45:10.502Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "modules": ["SMF Diameter Gx Credit-Control-Answer Handler"], "product": "Open5GS", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.3"}, {"status": "affected", "version": "2.7.4"}, {"status": "affected", "version": "2.7.5"}, {"status": "affected", "version": "2.7.6"}, {"status": "unaffected", "version": "2.7.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en Open5GS hasta la versi\u00f3n 2.7.6. La funci\u00f3n impactada es smf_gx_cca_cb del componente SMF Diameter Gx Credit-Control-Answer Gestor. La manipulaci\u00f3n resulta en denegaci\u00f3n de servicio. El ataque puede ser lanzado remotamente. El exploit ha sido publicado y puede ser utilizado para ataques. Se recomienda actualizar a la versi\u00f3n 2.7.7 para solucionar este problema. El parche se identifica como f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Se aconseja actualizar el componente afectado."}], "id": "CVE-2025-15687", "lastModified": "2026-09-29T11:10:00.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15687", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T12:35:16.345281Z", "version": "2.0.3"}}]}, "published": "2026-08-12T04:17:38.617", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/commit/f23d7a5e959acd8f37b925dc29b85f26b7d391cb"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/issues/4027"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/pull/4034"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/releases/tag/v2.7.7"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/21515527/SMF.crashes.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2025-15687"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/867119"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387283"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387283/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.7.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.7.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Open5GS", "source": "cna", "vendor": "n/a"}, "product": "open5gs", "vendor": "open5gs"}], "created": "2026-08-12T14:30:03.263097+00:00", "updated": "2026-08-12T17:30:06.538202+00:00", "vendors": ["open5gs", "open5gs$PRODUCT$open5gs"]}