Description

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4. It is recommended to apply a patch to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-24T05:16:55.277Z",
  "pubdate": "2026-08-24T05:16:55.277Z",
  "executiveSummary": "A reachable assertion vulnerability exists in Open5GS up to version 2.8.0 within the Home Subscriber Server (HSS) component. Specifically, the flaw resides in the handling of the User-Name argument processed within the src/hss/hss-cx-path.c source file. Remote threat actors can exploit this vulnerability by supplying a maliciously crafted User-Name parameter, triggering an application-level assertion failure.\nThe primary impact of this security flaw is a denial of service (DoS) condition, as the targeted Open5GS HSS process crashes immediately upon encountering the invalid input. This disruption affects core telecommunications signaling and subscriber authentication services. The attack vector is fully remote, requiring network accessibility to the vulnerable HSS interface without necessitating prior authentication or elevated privileges. Publicly available exploit material increases the operational risk, making immediate remediation essential for maintaining network availability.",
  "technicalDetails": "The vulnerability is rooted in inadequate input validation and error handling logic concerning the User-Name parameter within the src/hss/hss-cx-path.c file of the Open5GS HSS component. In software implementations, assertions are typically used to validate internal program invariants during development or debugging. If an assumption about input data formatting or state fails, the assertion triggers, causing the application to intentionally terminate to prevent undefined behavior.\nIn this specific context, a remote attacker transmits a specially manipulated User-Name argument over the network to the vulnerable HSS service. Upon receipt, the Cx interface handling routines parse the input payload within src/hss/hss-cx-path.c. Because the input does not conform to expected structural or semantic constraints, it violates the internal assumptions guarded by the assertion statement.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies the exposed network endpoint associated with the HSS Cx interface. Second, the attacker crafts a malicious signaling payload containing the anomalous User-Name argument designed to trigger the conditional check failure. Third, the attacker transmits the payload remotely to the target system. Fourth, the HSS component processes the payload inside src/hss/hss-cx-path.c, where the invalid argument violates the internal assertion condition. Fifth, the application executes the assertion macro, resulting in an immediate abort signal and termination of the HSS process.\nAffected versions include Open5GS up to version 2.8.0. The vulnerability requires network exposure to the HSS component, but no authentication or privileges are required to transmit the malicious input payload. The post-exploitation impact is limited to availability disruption via denial of service, as arbitrary code execution is typically not achievable through standard assertion faults."
}