Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.
Summary
A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Open5GS | 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6 | 2.7.7 | Patch available | CNA |
- Open5GS Vendor— Affected 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6 Fixed in 2.7.7 Patch available CNA
Remediation
- Fix · CNA Open5GS Fixed in 2.7.7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15687
- 2026-10-03 Alias added: GHSA-cfh6-r6wv-jf9h
- 2026-10-24 EPSS moved to the 50th–90th percentile
References
Patch 3
Sources
- CVE-2025-15687 · CVE Program
- CVE-2025-15687 · NVD
- FIRST EPSS
- GHSA-cfh6-r6wv-jf9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences