Researchers from Nanyang Technological University have published findings that highlight serious security weaknesses in mobile telecom cores. The report describes 4G/5G core flaws—dozens of vulnerabilities across signaling interfaces—that, if exploited, could lead to denial-of-service (DoS) conditions and even session hijacking, where an attacker interferes with a user’s network session.
Rather than pointing to a handful of isolated bugs, the study frames the problem as a recurring design and implementation pattern. According to the authors, many of the weaknesses share a single root cause: overly permissive, “blind” trust between network functions that becomes risky when cloud-native deployments expose interfaces that were previously harder to reach.
Why 4G and 5G core trust models became fragile
Historically, telecom core networks often relied on physical or network isolation to keep interfaces between components inside a controlled trust zone. That assumption becomes weaker as operators move toward cloud-native architectures, where core functions run more flexibly and interfaces may be reachable from broader network paths.
The researchers explain that this shift can expand the attack surface. If an attacker can reach core components over the internet (or through misconfigurations that expose control-plane endpoints), they may be able to interact with internal interfaces that were not intended for untrusted parties.
In the study, the recurring flaw pattern is coded as implicit trust errors (iTrues). The core idea is that one component may accept messages from another component without sufficiently validating message format, meaning, and resource availability—then act on them as if they were trustworthy.
Where the vulnerabilities live: signaling interfaces and protocols
The report focuses on signaling interfaces used in LTE/5G core environments. It examines multiple open-source LTE and 5G core implementations and evaluates them across two key control-plane protocols:
- GTP-C (GPRS Tunnelling Protocol Control Plane)
- PFCP (Packet Forwarding Control Protocol)
For LTE, the study covers two implementations: Open5GS and OpenAirInterface. For 5G, it evaluates five implementations: Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF.
Because the same trust assumptions appear across different components and deployments, the vulnerabilities are not only numerous—they are also linked by shared underlying behavior in how components validate incoming control messages.
How the researchers found 84 previously unknown issues
To uncover and analyze these problems, the researchers built an automated approach designed to discover “iTrue” patterns and filter out false leads.
The system described in the paper is an LLM-assisted multi-agent framework called iFinder. In broad strokes, it performs tasks such as:
- Summarizing known flaws and organizing them into detection patterns
- Using those patterns to search for new implicit trust errors in core network code
- Generating proof-of-concept (PoC) exploits for suspected iTrues
- Iterating on exploit development and validation based on test results
A crucial part of the workflow is reducing hallucinations and false positives. The authors mention a “code-specification cross-checking” technique that maps a suspected iTrue candidate to the protocol procedure it implements, then checks whether the code actually enforces the validation and resource checks that should be present.
After running the agents against seven 4G and 5G open-source core implementations, the researchers report a total of 84 previously unknown vulnerabilities. Most of them are already confirmed, and the majority received CVE identifiers.
DoS scenario: crashing control-plane behavior
One example highlighted in the report is a hypothetical DoS attack path targeting Open5GS LTE. In that scenario, the attacker can send specific GTPv2-C messages.
More specifically, the researchers describe how sending GTPv2-C Create Session Request messages can trigger a vulnerability during parsing. The consequence, in the hypothetical scenario, is a crash of the Serving Gateway Control plane (SGW-C).
This matters because a control-plane crash can disrupt service for subscribers and potentially degrade network operations beyond a single session, depending on how the core handles recovery and state management.
Session hijacking: taking over how user traffic is forwarded
The most worrying class of issues described in the study involves session hijacking. In this type of attack, the attacker aims to influence how the user plane routes traffic—potentially redirecting a victim’s uplink packets to an attacker-controlled destination.
According to the researchers, successful exploitation generally assumes the adversary can:
- Obtain IP addresses of core network components (for example via public documentation, passive enumeration, or active scanning)
- Reach internal core network interfaces
- Send arbitrary PFCP and GTP-C messages in a way that bypasses the intended trust model due to misconfiguration or missing enforcement
The attacker may be remote—outside the cellular core—or may be a malicious User Equipment (UE) connected to the network. In the malicious UE case, the attacker can inject crafted payloads into the uplink data stream.
Packet “smuggling” across boundaries
A key technique described is boundary bridging through tunneling. The researchers state that the attacker can “smuggle” crafted PFCP or GTP-C messages inside GTP-U packets. If strict boundary enforcement is missing, the messages can cross the boundary and then be parsed and processed by core components.
In other words, the core network may end up treating attacker-injected content as if it came from a trusted internal peer, even though it did not.
The sequence that redirects uplink traffic
The report then outlines a step-by-step hijacking sequence involving the UPF (User Plane Function). Conceptually, the flow looks like this:
- The attacker sends a PFCP Association Setup Request to the UPF.
- The victim UE performs an attach, causing the SMF to send a PFCP Session Establishment Request to the UPF.
- The attacker sends a PFCP Session Modification Request that reuses the victim’s PDR (Packet Detection Rule) ID but with a lower precedence value, while pointing it to an attacker-controlled forwarding action.
- The UPF admits the duplicate PDR and orders PDR entries by precedence, placing the malicious rule first.
- During processing, the UPF matches the malicious PDR and establishes a forwarding tunnel that routes the victim’s traffic to the attacker.
- As a result, the victim’s uplink traffic is forwarded to the attacker rather than to the intended internet destination.
At a high level, this class of flaw allows an attacker to inject a PFCP session modification so the UPF forwards the victim UE’s uplink traffic to an attacker-controlled endpoint.
Real-world impact: what session hijacking could reveal or disrupt
One of the paper’s authors, Ziyu Lin, provided additional context. The session hijacking flaw is not only described as a redirection issue; it can also enable observation and handling of victim packets at the attacker’s endpoint.
In practice, the attacker could decide whether to inspect, modify, forward, or discard traffic. That opens the door to several consequences, including:
- Traffic inspection, potentially including unencrypted application data
- Traffic manipulation by altering packets before forwarding
- Selective disruption, such as silently dropping redirected packets to disrupt connectivity for a specific subscriber without taking down the entire UPF
The report also notes that even if the payload is encrypted, metadata may still be visible. This can include destination IP addresses, timing, and traffic volume, which can help an attacker profile or target sessions more effectively.
Some flaws already hit commercial deployments
The study reports that the session hijacking vulnerability has been found in two real-world commercial 5G core networks. For one vendor, the issue in XproUPF has been addressed, identified as CVE-2026-8233 with a CVSS score of 4.6.
For the second commercial 5GC vendor, remediation was still in progress at the time of the reporting.
The authors also note how the same underlying flaw can appear across different products: CVE-2026-8233 and CVE-2026-36884 are described as representing the same underlying issue in two independently developed products. Additionally, CVE-2025-66776 is mentioned as another product-specific vulnerability in eUPF that can also result in session hijacking.
What operators and vendors should take away
The researchers emphasize that the number and similarity of the findings suggest a broader security challenge. Rather than being merely a small collection of implementation errors, the 4G/5G core flaws reflect a persistent security gap tied to validation and trust enforcement.
For network operators and vendors, the key implication is that moving to cloud-native deployment must come with stronger assurance that internal message trust boundaries are still enforced. If components can be reached directly and accept messages without adequate validation, the risk of DoS and session hijacking grows.
Ultimately, the study’s findings argue for urgent attention: improve validation of message structure and semantics, ensure resource and precedence handling is robust, and harden boundary enforcement so untrusted traffic cannot be interpreted as trusted control-plane instructions.
Conclusion
This report documents how implicit trust errors can surface as practical exploitation paths in both 4G and 5G core networks. With 84 previously unknown vulnerabilities identified across multiple open-source implementations—and with session hijacking confirmed in real commercial environments—the stakes for telecom security are clear. Strengthening trust validation, boundary enforcement, and control-plane input handling is no longer optional for modern mobile core deployments.
Source: https://thehackernews.com/2026/07/researchers-report-84-flaws-in-4g-and.html
