An unauthenticated remote denial of service vulnerability in Open5GS allows attackers to crash the NRF process, rendering the discovery service unresponsive.

This is a reachable assertion vulnerability (CWE-617) located in the Network Repository Function (NRF). An unauthenticated attacker with connectivity to the NRF can trigger a process crash by sending a request to create an NF with an invalid type via the Service Based Interface (SBI) and subsequently requesting that entity's data.

The exploitation of this vulnerability results in a complete denial of service for the NRF component. Given that the NRF is a critical orchestration point in 5G core networks, its unavailability prevents network functions from discovering one another, leading to significant service disruption. With a CVSS score of 7.5, this high-severity flaw poses a substantial risk to network availability and operational continuity.

Immediate Action: Upgrade all instances of Open5GS to version 2.7.6 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Monitor NRF logs for repeated attempts to register NF types that result in process restarts or service instability.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the NRF SBI interface to authorized network functions only, thereby reducing the attack surface.

Public Exploit Available: Unknown.

The high severity and potential for significant service disruption necessitate immediate attention. Organizations deploying Open5GS must prioritize the upgrade to version 2.7.6 as the primary mitigation strategy to eliminate the reachable assertion flaw. Until the patch is applied, ensure that access to the NRF is strictly limited to known, trusted components to prevent unauthorized exploitation.