Researchers Find 84 Implicit Trust Flaws in 4G and 5G Core Networks
Summary
NTU researchers report 84 previously unknown flaws in seven LTE/5G core implementations, linked to implicit trust between components. Their iFinder system helped identify the issues, including a PFCP flaw that can redirect a victim’s traffic.
Key points
- Researchers report 84 previously unknown vulnerabilities across seven open-source LTE/5G core implementations; 83 were confirmed by the researchers and 81 assigned CVE identifiers.
- The flaws affect GTP-C and PFCP signaling and stem from implicit trust between core network functions.
- The researchers developed iFinder, an LLM-assisted multi-agent system that identifies candidates and cross-checks them against protocol specifications and code.
- The article describes a PFCP Session Modification flaw in which a duplicate PDR ID can cause a UPF to forward a victim’s uplink traffic to an attacker.
- The study also describes a potential Open5GS LTE denial-of-service scenario involving a malformed Create Session Request that can crash the SGW-C.
- Researchers say the session-hijacking flaw was found on two commercial 5G core networks. Dotouch fixed the issue in XproUPF (CVE-2026-8233); another unnamed carrier was still remediating it.
- The attack scenarios depend on access to core network interfaces, which researchers say can become reachable through cloud deployment misconfigurations.
Article Details
- Attack Vectors
- Crafted GTPv2-C Create Session Request messages can trigger a crash in the Open5GS LTE Serving Gateway Control plane.
- A PFCP Session Modification Request that reuses a victim's PDR ID with higher priority and binds it to a malicious FAR can redirect the victim UE's uplink traffic to the attacker.
- Crafted PFCP or GTP-C messages may be smuggled inside GTP-U messages and delivered to core-network components when network boundary enforcement is insufficient.
- The researchers said exploitation requires access to internal core-network interfaces, which may become reachable through cloud-deployment misconfigurations; a remote adversary or malicious UE could send the messages.
- Defensive Notes
- Enforce strict network boundary controls to prevent tunneled PFCP or GTP-C messages from crossing into core-network interfaces.
- Validate signaling-message formats, semantics, resource availability, and uniqueness of PDR IDs rather than trusting messages from internal peers.
- Dotouch addressed the session-hijacking defect in XproUPF; the unnamed major 5G carrier was still remediating its affected network.
MITRE ATT&CK
T1499.004 · Application or System ExploitationThe article describes crafted GTPv2-C Create Session Request messages triggering a vulnerability that crashes the Open5GS LTE SGW-C.T1565.002 · Transmitted Data ManipulationThe described PFCP flaw lets an attacker install a higher-priority malicious forwarding rule and redirect a victim UE's uplink traffic to the attacker.
CVE
People
Vendors
Products
eUPFTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.free5GCTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.Open5GSTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.OpenAirInterfaceTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.SD-CoreTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.XproUPFTheir study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and XproUPF.