CVE-2025-41067
Reachable Assertion vulnerability in Open5GS
- Published
- Oct 27, 2025
- Updated
- Oct 29, 2025
- Assigning CNA
- INCIBE
- Evidence observed
- Aug 10, 2026
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
- Percentile
- 34.0%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.
Sources
1This repository contains the Proof-of-Concept (PoC) exploit scripts for two vulnerabilities, CVE-2025-41067 and CVE-2025-41068. These vulnerabilities affect the NRF (Network Repository Function) component of Open5GS in versions prior to 2.7.6 and can be triggered by an attacker to cause a Denial of Service (DoS).
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.