Open5GS versions up to 2.7.7 contain a flaw in the SMF component’s smf_nsmf_handle_update_data_in_vsmf function, where an attacker can manipulate the qosFlowProfile argument sent from a VSMF. This manipulation triggers a crash in the SMF process, causing a denial of service that can be triggered remotely. The flaw is publicly documented and may already be weaponized. The nature of the weakness is a missing input validation or handling failure, identified as CWE-404.

Any installation of Open5GS running SMF before version 2.7.8 is affected. The flaw exists in the file src/smf/nsmf-handler.c, specifically the smf_nsmf_handle_update_data_in_vsmf routine. This applies to all platforms where Open5GS is deployed as the core network SMF function, including telecom operators or research environments using the open source package.

The CVSS score of 5.3 indicates a moderate impact; however, the exploit is remote, publicly available, and could disrupt service availability. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. An attacker with network access to a VSMF that communicates with the SMF could craft a malicious qosFlowProfile payload to force the SMF to restart, leading to a denial of service that might affect data connectivity for end users. The risk remains clinically significant because it targets a critical control plane element of 5G networks.