CVE-2025-14955
Dec. 19, 2025, 6:15 p.m.
6.3
Medium
Description
A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component PFCP. The manipulation results in improper initialization. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. The patch is identified as 773117aa5472af26fc9f80e608d3386504c3bdb7. It is best practice to apply a patch to resolve this issue.
Product(s) Impacted
| Product | Versions |
|---|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-665
Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
References
Tags
CVSS Score
CVSS Data - 4.0
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Attack Requirements: NONE
- Privileges Required: NONE
- User Interaction: NONE
- Scope:
- Confidentiality Impact: NONE
- Integrity Impact: NONE
- Availability Impact: LOW
- Exploit Maturity: PROOF_OF_CONCEPT
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Published: Dec. 19, 2025, 5:15 p.m.
Last Modified: Dec. 19, 2025, 6:15 p.m.
Last Modified: Dec. 19, 2025, 6:15 p.m.
Status : Undergoing Analysis
CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.
More infoSource
cna@vuldb.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.