CVE-2024-51179

HIGH

Open5GS 2.7.1 - Denial of Service via PDU Session Establishment

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-51179. PoCs published by Lakshmirnr.

AI-analyzed exploit summary This PoC demonstrates a DoS vulnerability in Open5GS v2.7.1 by flooding crafted PFCP packets to the UPF/SMF, causing crashes due to a memory deallocation issue. The script uses Scapy to generate and send malicious packets with specific PFCP headers and F-SEID IEs.

Description

An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the Session Management Function (SMF), The Packet Data Unit (PDU) session establishment process.

Exploits (1)

nomisec WORKING POC 4 stars
by Lakshmirnr · poc
https://github.com/Lakshmirnr/CVE-2024-51179

This PoC demonstrates a DoS vulnerability in Open5GS v2.7.1 by flooding crafted PFCP packets to the UPF/SMF, causing crashes due to a memory deallocation issue. The script uses Scapy to generate and send malicious packets with specific PFCP headers and F-SEID IEs.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Open5GS v2.7.1
No auth needed
Prerequisites: UPF IP address · PFCP port (typically 8805) · SEID (Session Endpoint Identifier) · Access to user plane traffic for reconnaissance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory
https://github.com/Lakshmirnr/CVE-2024-51179

Scores

CVSS v3 7.5
EPSS 0.0103
EPSS Percentile 59.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (1)
open5gs/open5gs 2.7.1
Published Nov 12, 2024
Tracked Since Feb 18, 2026