CVE-2025-14954: Open5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertion
A vulnerability has been found in Open5GS up to 2.7.6. Affected is the function ogspfcppdrfindoradd/ogspfcpfarfindoradd/ogspfcpurrfindoradd/ogspfcpqerfindoradd in the library lib/pfcp/context.c of the component QER/FAR/URR/PDR. The manipulation leads to reachable assertion. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 442369dcd964f03d95429a6a01a57ed21f7779b7. Applying a patch is the recommended action to fix this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14954?
The severity of CVE-2025-14954 is considered high due to its potential impact on the functionality of Open5GS.
How do I fix CVE-2025-14954?
To fix CVE-2025-14954, upgrade Open5GS to version 2.7.6 or later.
What components are affected by CVE-2025-14954?
CVE-2025-14954 affects the QER, FAR, URR, and PDR components in Open5GS.
What library is associated with CVE-2025-14954?
CVE-2025-14954 is associated with the lib/pfcp/context.c library in Open5GS.
What versions of Open5GS are vulnerable to CVE-2025-14954?
Open5GS versions up to and including 2.7.5 are vulnerable to CVE-2025-14954.