CVE-2025-29339

{"id": "CVE-2025-29339", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-04-22T17:16:46.827", "references": [{"url": "https://github.com/open5gs/open5gs/issues/3727", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Session Establishment Request with PDN Type=0, the UPF fails to handle the invalid value propagated from SMF (or via direct attack), triggering a fatal assertion check and causing a daemon crash."}, {"lang": "es", "value": "Un problema en UPF en versiones de Open5GS UPF hasta la v2.7.2 genera una vulnerabilidad de fallo de aserci\u00f3n en la validaci\u00f3n de par\u00e1metros de sesi\u00f3n PFCP. Al procesar una solicitud de establecimiento de sesi\u00f3n PFCP con PDN tipo 0, UPF no gestiona el valor no v\u00e1lido propagado desde SMF (o mediante un ataque directo), lo que activa una comprobaci\u00f3n de aserci\u00f3n fatal y provoca un fallo del demonio."}], "lastModified": "2025-06-19T00:23:24.013", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8160C0A-E77F-487D-B5E0-C6657E80D327", "versionEndIncluding": "2.7.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}