CVE-2025-14955

LowCVSS 3.7/10Last modified Oct 13, 2026

Description

A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component PFCP. The manipulation results in improper initialization. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. The patch is identified as 773117aa5472af26fc9f80e608d3386504c3bdb7. It is best practice to apply a patch to resolve this issue.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-665

Affected software

Vendor	Product	Versions
n/a	Open5GS	2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5

References

https://github.com/open5gs/open5gs/
https://github.com/open5gs/open5gs/commit/773117aa5472af26fc9f80e608d3386504c3bdb7Patch
https://github.com/open5gs/open5gs/issues/4182Exploit, Issue Tracking, Vendor Advisory
https://github.com/open5gs/open5gs/issues/4182#issue-3670797098Exploit, Issue Tracking, Vendor Advisory
https://github.com/open5gs/open5gs/issues/4182#issuecomment-3616081878Issue Tracking
https://vuldb.com/?ctiid.337591Permissions Required, VDB Entry
https://vuldb.com/?id.337591Third Party Advisory, VDB Entry
https://vuldb.com/?submit.716841Third Party Advisory, VDB Entry
https://github.com/open5gs/open5gs/issues/4182Exploit, Issue Tracking, Vendor Advisory
https://github.com/open5gs/open5gs/issues/4182#issue-3670797098Exploit, Issue Tracking, Vendor Advisory
https://github.com/open5gs/open5gs/issues/4182#issuecomment-3616081878Issue Tracking

Timeline

Published: Dec 19, 2025
Last modified: Oct 13, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-149567.1A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the CVE-2025-149575.5A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/CVE-2025-149587.8A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function CVE-2025-149599.8A weakness has been identified in code-projects Simple Stock System 1.0. This issue affects some unknown processing of the file /market/sign CVE-2025-14966.5Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authenticati CVE-2025-149609.8A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1.0. Impacted is an unknown function of the CVE-2025-149619.8A vulnerability was detected in code-projects Simple Blood Donor Management System 1.0. The affected element is an unknown function of the f CVE-2025-149626.1A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php CVE-2025-149637.8A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated CVE-2025-149649.8A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. S CVE-2025-149655.5A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete CVE-2025-149667.2A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/control