CVE-2025-15685

CVE-2025-15685 is a memory corruption vulnerability in freeDiameter, the C library that handles DIAMETER protocol parsing for Open5GS 4G and 5G core networks. The CVSS 6.3 rating almost certainly undersells the actual risk for telecom operators. The critical issue isn't the bug itself — it's the pattern it belongs to. FreeDiameter has produced near-identical vulnerabilities before: CVE-2023-41957 and CVE-2022-25530 share the same phenotype — memory corruption in DIAMETER message parsing, discovered through fuzzing, disclosed with the 'unknown functionality' qualifier. That qualifier means the root-cause analysis was never completed, so the full attack surface remains unmapped. You're not just assessing one vulnerability; you're assessing a code architecture that has repeatedly failed the same way. The blast radius matters more than the CVSS score suggests. FreeDiameter sits at the trust boundary where inbound Access-Request messages are parsed before authentication state is established. Memory corruption at this layer can corrupt the authentication state machine itself — not just crash a process, but potentially persist within the core network's authentication fabric. The HSS isolation that operators rely on is downstream from this parsing layer; it protects the HSS from compromise but doesn't constrain a freeDiameter exploit that corrupts state before authentication completes. For operators running Open5GS: patch when the fix is available, but recognize that point patching freeDiameter addresses symptoms, not the underlying architecture. The DIAMETER state machine parsing code in this library hasn't been rewritten — it's been patched at fault points while the complex protocol handling logic persists unchanged. Until the parsing architecture is refactored rather than point-patched, treat this CVE as evidence that your authentication layer is a mutable trust surface. Network-level filtering upstream of freeDiameter is the compensating control that actually addresses the architectural position problem — assuming the stack handles authentication honestly at the edge is no longer defensible.

Reviewed through automated stages and approved by a human before publication.