A flaw in the Open5GS SGWC component’s sgwc_s11_handle_modify_bearer_request function allows an attacker to send a specially crafted modify bearer request that triggers a crash, causing the SGWC service to become unavailable. The vulnerability is due to improper handling of certain request parameters, leading to the remote denial of service. It can disrupt traffic routing in cellular networks and affect all subscribers linked to the affected SGWC instance.

The issue affects the Open5GS implementation up to version 2.7.6. It specifically targets the SGWC (Serving Gateway Control) module responsible for managing S11 interface messages. Users running Open5GS distributions before the release of a security fix are vulnerable if the SGWC component is exposed to external traffic.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is reported as less than 1%, meaning that exploitation probability is very low but not zero. The configuration requirement is remote access to the SGWC S11 interface, with no additional privileged access needed. The vulnerability is not listed in the CISA KEV catalog, and the exploit has been disclosed publicly.