The Hacker News30%
Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw 25%
By Ravie Lakshmanan19%
7/31/2026, 4:55:00 AM
Keywords: 4g, 5g, Vulnerabilities, Session Hijacking, Dos, Core Networks, Security Flaws, Gtp C, Pfcp, Itrue
BS Summary: This article contains 18 faulty reasoning types, including Unattributed Quote, Pessimism Bias, and Framing Effect, with Negativity Bias as the most egregious example at 25.2% saturation with 247 hits. Analysis detected 1,464 faulty-reasoning hits from 981 analyzed words, generating a BS Score of 31.6% and a BS Rank of 25% (20,258 of 26,768 articles). This article is better (less manipulative) than 75.70% of the article peer group.
An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session.
The findings have been released by a group of researchers from Singapore's Nanyang Technological University in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis."
The study has uncovered dozens of vulnerabilities in the signaling interfaces of LTE/5G core networks, and specifically covers two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF) across two core signaling protocols, GPRS Tunnelling Protocol Control Plane (GTP-C) and Packet Forwarding Control Protocol (PFCP).
"Our research finds these vulnerabilities share a single recurring root cause, implicit trust between core network functions, and are present in widely used open-source LTE/5G cores that back research testbeds and commercial deployments alike," the researchers said.
While cellular core networks (CNs) have historically incorporated physical isolation as a means to ensure interfaces between core network functions operate within a trust zone, the transition to cloud-native deployments has made the trust model "fragile" and expanded the attack surface, allowing adversaries to potentially reach previously internal interfaces.
The researchers said they found a pattern of blind trust among CN components, which, coupled with weaknesses in those interfaces, can be exploited by an external actor for conducting malicious activities, including DoS and session hijacking, when they become reachable over the internet.
These errors have been codenamed implicit trust errors (iTrue).
To better detect such iTrues and understand their consequences, the study involved the development of a large language model (LLM)-assisted multi-agent system dubbed iFinder that performs a series of tasks: summarize known flaws, categorize them into detection patterns, and use them as a foundation to discover new iTrues in CN implementations.
Some of the identified weaknesses relate to a lack of due diligence in validating message format, message semantics, and resource availability, with the CN components opting to blindly act on messages received from internal peers.
In the next phase, hallucinations and false positives are weeded out using a "novel code-specification cross-checking technique," following which an LLM-driven approach is used to generate proof-of-concept (PoC) exploits for potential iTrues and refine them iteratively by executing them against CN implementations and analyzing the results.
The elimination of false positives, the researchers said, involves mapping an iTrue candidate to the protocol procedure it implements and checking whether the necessary validation and resource checks are actually enforced in the codebase.
Running the agent against the aforementioned seven 4G and 5G open-source CN implementations has uncovered 84 previously unknown vulnerabilities, out of which 83 have already been confirmed and 81 have been assigned CVE identifiers.
Some of the iTrue flaws in 5G systems are said to have been inherited from their 4G counterparts, indicating how security risks can jump generations and how a failure to adapt legacy to modern deployments can bring forth new concerns not previously accounted for.
That said, successful attacks based on the DoS and session hijacking iTrue flaws assumes the adversary can obtain the IP address of core network components, such as from public documentation, passive enumeration, or active scanning, as well as have access to internal core network interfaces and send arbitrary PFCP and GTP-C messages in violation of the trust model by exploiting misconfigurations in cloud deployment.
This attacker could be remote (i.e., located outside of the cellular core network) or a malicious User Equipment (UE) used to connect to a mobile network, the latter of which entails injecting carefully crafted payloads into the uplink data stream.
"By exploiting protocol tunnelling and network boundary bridging, the attacker smuggles crafted PFCP or GTP-C messages inside GTP-U messages so that, absent strict boundary enforcement, they cross the boundary and are delivered to and parsed by core-network components," the researchers said.
In a hypothetical DoS attack scenario against Open5GS LTE, an attacker can send GTPv2-C messages to trigger the vulnerability when parsing GTPv2-C Create Session Request messages, causing the Serving Gateway Control plane (SGW-C) to crash.
As for session hijacking, an internet adversary can perform the following sequence of actions -
* The attacker sends a PFCP Association Setup Request to the User Plane Function (UPF).
* The victim UE initiates an "attach," triggering the SMF to send a PFCP Session Establishment Request to the UPF.
* The attacker then issues a PFCP Session Modification Request that reuses the victim's Packet Detection Rule (PDR) ID with a lower Precedence value (higher priority) and binds it to a malicious Forwarding Action Rule (FAR).
* The UPF admits the duplicate PDR and sorts PDRs by precedence, placing the malicious rule ahead of the legitimate one.
* During packet processing, the UPF matches the malicious PDR first, and establishes a new forwarding tunnel between UPF and the attacker.
* The victim's uplink traffic is forwarded to the attacker rather than to the internet.
"The attacker could be remote (i.e., located outside of the cellular core network) or a malicious User Equipment (UE) used to connect to a mobile network, the latter of which entails injecting carefully crafted payloads into the uplink data stream."
The session hijacking vulnerability has been discovered on two real-world commercial 5G core networks.
One vendor, Dotouch, has since addressed the defect in XproUPF (CVE-2026-8233, CVSS score: 4.6).
The second commercial 5GC vendor, an unnamed major 5G carrier, is still in the remediation process.
"The continually increasing number of vulnerabilities demonstrates that this is not a small collection of isolated implementation bugs, but a broader and ongoing security problem that requires urgent attention from vendors and network operators," Ziyu Lin, one of the authors of the study, said in a statement shared with The Hacker News.
Speakers
1speaker5.3%attributed speech929writer words
Selected voice
100%flagged-word coverageZiyu Lin
52 attributed words100% of attributed speech68% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.