CVE-2025-6952

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-6952
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6952.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-6952
Published
2025-07-01T11:32:07.418Z
Modified
2026-08-12T15:14:56.255772Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Open5GS AMF Service amf-sm.c amf_state_operational assertion
Details

A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amfstateoperational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the local host. The identifier of the patch is 53e9e059ed96b940f7ddcd9a2b68cb512524d5db. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.7.3"
                },
                {
                    "last_affected": "2.7.3"
                },
                {
                    "introduced": "2.7.4"
                },
                {
                    "last_affected": "2.7.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6952.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/open5gs/open5gs

Affected ranges

Type
GIT
Repo
https://github.com/open5gs/open5gs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d9d3abdd480be96fac3bc8a997e83446648763ca
Fixed
53e9e059ed96b940f7ddcd9a2b68cb512524d5db
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.7.0
2.7.1
2.7.2
2.7.5
v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.8
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v2.*
v2.0.0
v2.0.18
v2.0.22
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v2.1.5
v2.1.7
v2.2.0
v2.2.1
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.2
v2.3.6
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.5
v2.4.7
v2.4.8
v2.4.9
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.5

Database specific

vanir_signatures 
[
    {
        "target": {
            "function": "udm_state_operational",
            "file": "src/udm/udm-sm.c"
        },
        "id": "CVE-2025-6952-03173c7f",
        "signature_type": "Function",
        "digest": {
            "function_hash": "323860662404170145105739983002700674363",
            "length": 11823.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "bsf_state_operational",
            "file": "src/bsf/bsf-sm.c"
        },
        "id": "CVE-2025-6952-096d02ba",
        "signature_type": "Function",
        "digest": {
            "function_hash": "169297890812598482655195057879256001473",
            "length": 8397.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/nssf/nssf-sm.c"
        },
        "id": "CVE-2025-6952-0d6b1e41",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "sepp_state_operational",
            "file": "src/sepp/sepp-sm.c"
        },
        "id": "CVE-2025-6952-0e950f6c",
        "signature_type": "Function",
        "digest": {
            "function_hash": "43854961896716596612533770592863654278",
            "length": 8184.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "scp_state_operational",
            "file": "src/scp/scp-sm.c"
        },
        "id": "CVE-2025-6952-11192596",
        "signature_type": "Function",
        "digest": {
            "function_hash": "115761339021134433597358708996735584011",
            "length": 6075.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/sepp/sepp-sm.c"
        },
        "id": "CVE-2025-6952-15bfbbfa",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "180775463221665795670784667678122758193",
                "78008312970413678147419088690677545159",
                "335894009388323858402132913254928037963",
                "233208380461537977998890901931661574142",
                "212592143407863426752519810258030958346",
                "57747584521099602098695325206446770174",
                "266981258601478568106309940949147450848"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "nssf_state_operational",
            "file": "src/nssf/nssf-sm.c"
        },
        "id": "CVE-2025-6952-21f501f7",
        "signature_type": "Function",
        "digest": {
            "function_hash": "41871002338918383071405389123682863107",
            "length": 6266.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/udm/udm-sm.c"
        },
        "id": "CVE-2025-6952-37cf2b8c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/bsf/bsf-sm.c"
        },
        "id": "CVE-2025-6952-43139f6b",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "pcf_state_operational",
            "file": "src/pcf/pcf-sm.c"
        },
        "id": "CVE-2025-6952-4cc7572f",
        "signature_type": "Function",
        "digest": {
            "function_hash": "190656544469541762202128748547905481258",
            "length": 16344.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "ausf_state_operational",
            "file": "src/ausf/ausf-sm.c"
        },
        "id": "CVE-2025-6952-570ef579",
        "signature_type": "Function",
        "digest": {
            "function_hash": "62258973356239654486327936380122178354",
            "length": 9104.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/ausf/ausf-sm.c"
        },
        "id": "CVE-2025-6952-59201a5e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "amf_state_operational",
            "file": "src/amf/amf-sm.c"
        },
        "id": "CVE-2025-6952-5a9ee2d0",
        "signature_type": "Function",
        "digest": {
            "function_hash": "12073224857365100759152166994000423034",
            "length": 20019.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/udr/udr-sm.c"
        },
        "id": "CVE-2025-6952-73df91d6",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "smf_state_operational",
            "file": "src/smf/smf-sm.c"
        },
        "id": "CVE-2025-6952-920d41c7",
        "signature_type": "Function",
        "digest": {
            "function_hash": "133828695507423527128554945178447990691",
            "length": 22824.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/smf/smf-sm.c"
        },
        "id": "CVE-2025-6952-a911e602",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "128627164339641144772660657834723804054",
                "77792219436036819923616459644926677141",
                "243686938322959616245940752995967358172",
                "230672088103451449055323794402881848930",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/amf/amf-sm.c"
        },
        "id": "CVE-2025-6952-c173d9ca",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "128627164339641144772660657834723804054",
                "77792219436036819923616459644926677141",
                "243686938322959616245940752995967358172",
                "230672088103451449055323794402881848930",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/scp/scp-sm.c"
        },
        "id": "CVE-2025-6952-c37b98fc",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "function": "udr_state_operational",
            "file": "src/udr/udr-sm.c"
        },
        "id": "CVE-2025-6952-cae02294",
        "signature_type": "Function",
        "digest": {
            "function_hash": "21372586576579253908168876100696914927",
            "length": 6633.0
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/pcf/pcf-sm.c"
        },
        "id": "CVE-2025-6952-ed8319e9",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "62014122319280197082590955016029193925",
                "239831060957867957189317048131296970395",
                "133333657416637106975090855475393366284",
                "191592832503660550192888451752904098536",
                "241000596103850298838016277564531598802",
                "34063825366171983140642353713142050516"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T15:14:56Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6952.json"