Security readout for executives and security teams
Plain-English summary
This flaw can crash an OMEC UPF component that carries mobile user-plane traffic. A network attacker with access to the PFCP/N4 endpoint could repeatedly interrupt service. The bundle does not show data theft, integrity impact, active exploitation, or a confirmed fix.
Executive priority
Treat this as a high-priority availability risk for mobile core environments using the affected OMEC UPF component. Focus on exposure reduction and vendor guidance, especially where PFCP is reachable beyond trusted peers.
Technical view
CVE-2025-65568 affects omec-project UPF pfcpiface in upf-epc-pfcpiface:2.1.3-dev. After PFCP association, improper validation of an empty or truncated IPv4 field in CreateFAR leads parseFAR() to call ip2int(), causing an out-of-bounds read and index-out-of-range panic.
Likely exposure
Exposure is likely limited to deployments running the named OMEC UPF pfcpiface build with reachable N4/PFCP service. Public internet exposure would materially increase risk, but the sources do not identify affected CPEs or additional versions.
Exploitation context
The CVE is not listed as KEV in the bundle, and no cited source confirms active exploitation. Exploitation requires the ability to send PFCP Session Establishment Request traffic to the UPF N4/PFCP endpoint.
Researcher notes
The bundle supports CWE-125 and CVSS 7.5 availability-only impact. Affected metadata is incomplete: vendor, product, CPEs, and fixed versions are not enumerated beyond the descriptive reference to OMEC UPF pfcpiface 2.1.3-dev.
Mitigation direction
- Check OMEC UPF guidance and issue 962 for fixed versions or vendor-recommended changes.
- Restrict PFCP/N4 access to trusted control-plane peers only.
- Block untrusted network paths to the UPF PFCP endpoint.
- Add monitoring and restart controls for repeated pfcpiface panics.
- Prioritize upgrade or isolation for upf-epc-pfcpiface:2.1.3-dev deployments.
Validation and detection
- Inventory OMEC UPF deployments and confirm pfcpiface image or package versions.
- Verify whether upf-epc-pfcpiface:2.1.3-dev is present in production or labs.
- Confirm PFCP/N4 listeners are not reachable from untrusted networks.
- Review UPF logs for parseFAR(), ip2int(), or index-out-of-range panic events.
- Check firewall and segmentation rules around control-plane to user-plane traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-65568 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/omec-project/upf/issues/962CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.