A flaw in the NGAP PathSwitchRequest message handler allows an attacker to bypass authentication checks, enabling unauthorized use of the service. The weakness can be triggered remotely and a publicly available exploit exists. The impact is that a malicious entity could gain control of the interface that normally requires legitimate authentication, potentially exposing sensitive signaling and traffic.

The vulnerability affects the Open5GS project, specifically versions up to and including 2.7.6. Any installation using those versions of the NGAP PathSwitchRequest handler is susceptible.

The CVSS score of 6.9 classifies the issue as moderate in severity, while EPSS data is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, exploiting the NGAP protocol via crafted PathSwitchRequest messages. Because the exploit is publicly available, threat actors may attempt to target vulnerable deployments without significant barriers.