A reachable assertion flaw in NewPlane Open5GS, an open-source 5G core network implementation, allows unauthenticated remote attackers to cause a denial of service against the discovery service.

The vulnerability is a reachable assertion (CWE-617) within the Network Repository Function (NRF) component. An unauthenticated attacker with network connectivity to the NRF can send a specific Service Based Interface (SBI) request that attempts to delete the NRF's own registry, triggering an assertion failure that crashes the process.

The successful exploitation of this vulnerability results in a complete denial of service for the Open5GS discovery function. Given that the NRF is a critical component for service registration and discovery in 5G core networks, this disruption can lead to significant network instability and service outages. With a CVSS score of 7.5, this high-severity vulnerability poses a substantial risk to operational continuity for telecommunications providers relying on this software.

Immediate Action: Upgrade the Open5GS deployment to version v2.7.6 or later, where the vendor has implemented a fix for the assertion error.

Proactive Monitoring: Monitor NRF process logs and system health metrics for unexpected restarts or service crashes that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the NRF interface to trusted entities only, using firewalls or network segmentation to prevent arbitrary remote requests from reaching the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Organizations utilizing Open5GS must prioritize the update to version v2.7.6 immediately to eliminate the risk of service disruption. Given the availability of a public proof-of-concept and the critical nature of core network functions, delaying this remediation exposes the infrastructure to potential denial-of-service attacks that could impact downstream network operations.