CVE-2025-65805
HighSummary
OpenAirInterface CN5G AMF up to version 2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by sending an imsi string longer than 1000 to port N1.
Risk Assessment
The vulnerability can lead to AMF crashes and, in worst cases, remote code execution, posing a serious threat to network integrity.
Recommendation
Update AMF to a patched version immediately and restrict access to port N1 to trusted sources only.
Other vulnerabilities in OpenAirInterface CN5G AMF
See all- CVE-2025-66786High
OpenAirInterface CN5G AMF up to version 2.0.1 has a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to the AMF's SBI interface to launch a denial-of-service attack.
- CVE-2024-24443Medium
An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.
- CVE-2024-24451High
A stack overflow vulnerability exists in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to version 2.0.0. An attacker can repeatedly establish SCTP connections over the N2 interface, causing a system crash.
- CVE-2024-24445Medium
A null dereference vulnerability in OpenAirInterface CN5G AMF (oai-cn5g-amf) version 2.0.0 and earlier occurs when handling unsupported NGAP protocol messages. An attacker with network-adjacent access can trigger a denial of service.
- CVE-2024-24444High
In OpenAirInterface CN5G AMF up to version 2.0.0, improper file descriptor handling for closed connections was found. An attacker can repeatedly establish SCTP connections via the N2 interface, leading to resource exhaustion and Denial of Service (DoS).
- CVE-2024-24442High
A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message.
Original NVD description (English source)
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF.