Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

An academic study has disclosed a “widespread class” of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user’s network session.

The findings have been released by a group of researchers from Singapore’s Nanyang Technological University in a paper titled “Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis.”

The study has uncovered dozens of vulnerabilities in the signaling interfaces of LTE/5G core networks, and specifically covers two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF) across two core signaling protocols, GPRS Tunnelling Protocol Control Plane (GTP-C) and Packet Forwarding Control Protocol (PFCP).

“Our research finds these vulnerabilities share a single recurring root cause, implicit trust between core network functions, and are present in widely used open-source LTE/5G cores that back research testbeds and commercial deployments alike,” the researchers said.

While cellular core networks (CNs) have historically incorporated physical isolation as a means to ensure interfaces between core network functions operate within a trust zone, the transition to cloud-native deployments has made the trust model “fragile” and expanded the attack surface, allowing adversaries to potentially reach previously internal interfaces.

The researchers said they found a pattern of blind trust among CN components, which, coupled with weaknesses in those interfaces, can be exploited by an external actor for conducting malicious activities, including DoS and session hijacking, when they become reachable over the internet. These errors have been codenamed implicit trust errors (iTrue).

To better detect such iTrues and understand their consequences, the study involved the development of a large language model (LLM)-assisted multi-agent system dubbed iFinder that performs a series of tasks: summarize known flaws, categorize them into detection patterns, and use them as a foundation to discover new iTrues in CN implementations.

Some of the identified weaknesses relate to a lack of due diligence in validating message format, message semantics, and resource availability, with the CN components opting to blindly act on messages received from internal peers.

Overview of the iFinder framework

In the next phase, hallucinations and false positives are weeded out using a “novel code-specification cross-checking technique,” following which an LLM-driven approach is used to generate proof-of-concept (PoC) exploits for potential iTrues and refine them iteratively by executing them against CN implementations and analyzing the results.

The elimination of false positives, the researchers said, involves mapping an iTrue candidate to the protocol procedure it implements and checking whether the necessary validation and resource checks are actually enforced in the codebase.

Running the agent against the aforementioned seven 4G and 5G open-source CN implementations has uncovered 84 previously unknown vulnerabilities, out of which 83 have already been confirmed and 81 have been assigned CVE identifiers.

Some of the iTrue flaws in 5G systems are said to have been inherited from their 4G counterparts, indicating how security risks can jump generations and how a failure to adapt legacy to modern deployments can bring forth new concerns not previously accounted for.

Example attack exploiting duplicate PDR IDs in PFCP Session Modification Request messages to trigger session hijacking in UPF by abusing missing uniqueness validation

That said, successful attacks based on the DoS and session hijacking iTrue flaws assumes the adversary can obtain the IP address of core network components, such as from public documentation, passive enumeration, or active scanning, as well as have access to internal core network interfaces and send arbitrary PFCP and GTP-C messages in violation of the trust model by exploiting misconfigurations in cloud deployment.

This attacker could be remote (i.e., located outside of the cellular core network) or a malicious User Equipment (UE) used to connect to a mobile network, the latter of which entails injecting carefully crafted payloads into the uplink data stream.

“By exploiting protocol tunnelling and network boundary bridging, the attacker smuggles crafted PFCP or GTP-C messages inside GTP-U messages so that, absent strict boundary enforcement, they cross the boundary and are delivered to and parsed by core-network components,” the researchers said.

In a hypothetical DoS attack scenario against Open5GS LTE, an attacker can send GTPv2-C messages to trigger the vulnerability when parsing GTPv2-C Create Session Request messages, causing the Serving Gateway Control plane (SGW-C) to crash. As for session hijacking, an internet adversary can perform the following sequence of actions –

The attacker sends a PFCP Association Setup Request to the User Plane Function (UPF).
The victim UE initiates an “attach,” triggering the SMF to send a PFCP Session Establishment Request to the UPF.
The attacker then issues a PFCP Session Modification Request that reuses the victim’s Packet Detection Rule (PDR) ID with a lower Precedence value (higher priority) and binds it to a malicious Forwarding Action Rule (FAR).
The UPF admits the duplicate PDR and sorts PDRs by precedence, placing the malicious rule ahead of the legitimate one.
During packet processing, the UPF matches the malicious PDR first, and establishes a new forwarding tunnel between UPF and the attacker.
The victim’s uplink traffic is forwarded to the attacker rather than to the internet.

“At a high level, this flaw allows an attacker to inject a PFCP Session Modification Request, causing the User Plane Function (UPF) to forward the victim UE’s uplink traffic to the attacker,” the researchers noted.

The session hijacking vulnerability has been discovered on two real-world commercial 5G core networks. One vendor, Dotouch, has since addressed the defect in XproUPF (CVE-2026-8233, CVSS score: 4.6). The second commercial 5GC vendor, an unnamed major 5G carrier, is still in the remediation process.

“The continually increasing number of vulnerabilities demonstrates that this is not a small collection of isolated implementation bugs, but a broader and ongoing security problem that requires urgent attention from vendors and network operators,” Ziyu Lin, one of the authors of the study, said in a statement shared with The Hacker News.

Read Full Article At Source