Open5GS up to version 2.7.6 contains a race condition in the function gmm_state_security_mode of the NGAP handover component. A malicious actor can trigger the condition by sending crafted messages, leading to unpredictable behavior during handover. The bug is remote, the required complexity is high and the exploitation difficulty is considered difficult, yet an exploit has already been released to the public. The CVSS score of 2.3 indicates a low overall severity.

The vulnerability affects the Open5GS project’s AMF component, specifically the gmm_state_security_mode routine. All installations using Open5GS versions up to and including 2.7.6 are susceptible; newer releases are not indicated as vulnerable.

With a CVSS score of 2.3 and no EPSS data available, the current risk is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires remote delivery of a specially crafted NGAP handover request, and even though the public exploit exists, the complexity threshold keeps active exploitation unlikely at present. Continued monitoring for attempts and awaiting an official fix is advisable.