A critical denial-of-service vulnerability in OpenAirInterface CN5G AMF allows unauthenticated remote attackers to crash the service via malformed JSON payloads.

The vulnerability is a logical error occurring during the processing of JSON requests within the Service Based Interface (SBI) of the Access and Mobility Management Function (AMF). Because the interface does not require authentication, any remote attacker can submit crafted data to exhaust system resources or terminate the service.

The exploitation of this vulnerability results in a denial-of-service, which directly impacts the availability of core network functions. Given the CVSS score of 7.5, the high impact on availability can lead to significant service disruption in telecommunications environments, potentially causing outages for connected users and requiring manual intervention to restore operations.

Immediate Action: Organizations should restrict network access to the SBI interface to trusted entities only and monitor for vendor-provided patches addressing the logical flaw in JSON processing.

Proactive Monitoring: Security teams should monitor system logs for unusually large or malformed JSON payloads targeting the AMF SBI interface and track service restart patterns that may indicate a successful crash.

Compensating Controls: Implement an API gateway or Web Application Firewall (WAF) capable of inspecting and validating JSON schema compliance before requests reach the AMF to block malformed traffic.

Public Exploit Available: Yes, a proof-of-concept exists, as documented in the technical write-up referenced in the CVE record.

Given the availability of a proof-of-concept and the ease of exploitation, this vulnerability poses a credible risk to network availability. Administrators should prioritize network segmentation for the SBI interface and prepare to deploy the vendor update as soon as it becomes available to prevent service interruption.