84 Vulnerabilities in 4G and 5G Network Cores: From Denial of Service to Session Hijacking

A team of researchers from Nanyang Technological University (Singapore) has described a “widespread class” of vulnerabilities in the cores of 4G and 5G cellular networks. When successfully exploited, these flaws make it possible to trigger a denial of service (DoS) or even hijack a user's network session, gaining control over their traffic.

A Single Root Cause — “Implicit Trust”

The work, titled “Understanding Implicit Trust Errors in Core Carrier Networks,” covers two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core and eUPF), as well as two signaling protocols — GTP-C and PFCP. According to the authors, all the problems they found trace back to a single root: the network functions of the core blindly trust one another and process incoming messages without verification.

In the past, such trust was justified by the physical isolation of interfaces within a trusted zone. But the shift to cloud-native deployments has made this model fragile: interfaces that were once internal can now become reachable from the outside. The researchers dubbed errors of this kind implicit trust errors (iTrue) — they stem from the absence of checks on message format, semantics and resource availability.

Hunting With AI

To detect such defects, the authors built a multi-agent system called iFinder on top of large language models. It generalizes known flaws, extracts detection patterns and uses them to search for new vulnerabilities, then automatically generates and iteratively refines PoC exploits. To weed out “hallucinations” and false positives, the code is cross-checked against the protocol specification.

A run across the seven open-source implementations revealed 84 previously unknown vulnerabilities: 83 have already been confirmed, and 81 have received CVE identifiers. Some of the 5G problems are inherited from 4G — a telling example of how risks leap from one generation to the next.

How Session Hijacking Works

The attack on the UPF (User Plane Function) exploits the absence of a uniqueness check on rules. The attacker sends a PFCP Session Modification Request, reusing the victim's PDR identifier but with a higher priority and a binding to a malicious forwarding rule (FAR). The UPF places the forged rule ahead of the legitimate one, and the victim's uplink traffic goes not to the internet but to the attacker. In the DoS scenario against Open5GS LTE, a specially crafted Create Session Request causes the SGW-C to crash.

Carrying out the attack requires access to the core's internal interfaces and knowledge of the IP addresses of its components, obtained from documentation, passive enumeration or scanning. The attacker could be either a remote adversary or a malicious subscriber device that “smuggles” PFCP and GTP-C messages inside GTP-U where boundary isolation is weak.

The session-hijacking vulnerability has been confirmed on two commercial 5G cores. Dotouch has fixed the defect in XproUPF (CVE-2026-8233, CVSS 4.6), while the second operator is still working on a patch. According to one of the authors, Ziyu Lin, the growing number of findings proves that this is not a matter of scattered bugs but a systemic problem requiring urgent attention from vendors and operators.

Source: The Hacker News