A flaw in the udm_state_operational function of Open5GS’s smf-registrations endpoint allows a remote attacker to manipulate the service and trigger a denial of service. The vulnerability is an instance of CWE-404, where improper resource shutdown or release can lead to loss of service availability. When exploited, the server becomes unable to process legitimate requests for the endpoint, disrupting network functions that rely on it.

Open5GS open5gs software, versions up to and including 2.7.7, is affected. The flaw exists in the smf-registrations endpoint handled by udm_state_operational in the udm‑sm.c source file.

The CVSS score of 5.3 indicates a moderate severity. The exploit is available publicly and can be launched remotely against the endpoint, though the EPSS score is not reported. The vulnerability is not listed in CISA KEV, but because the code is exposed over the network, a malicious actor could deploy the known exploit to interrupt service. The risk is heightened for environments where the smf-registrations endpoint is accessible from untrusted networks.