CVE-2025-15687

MediumCVSS 4.3/10Last modified Sep 29, 2026

Description

A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.7.7 is recommended to address this issue. The patch is identified as f23d7a5e959acd8f37b925dc29b85f26b7d391cb. Upgrading the affected component is advised.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-156889.3Unauthenticated SQL Injection in Capella <= 2.5.5 versions.CVE-2025-156899.8Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.CVE-2025-156906.8The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in CVE-2025-156915.3The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from CVE-2025-156923.5The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML at CVE-2025-156932.7The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-brows CVE-2025-156943.5The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admi CVE-2025-156953.5The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end sc CVE-2025-156966.8The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in th CVE-2025-156977.1The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly access CVE-2025-156983.5The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege CVE-2025-15709.8The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatio