5G Mobile Core Vulnerabilities: 84 Zero-Day Flaws Found
Widespread Impact Across Open-Source Core Stacks
For decades, the architectural underpinnings of mobile networks relied upon implicit trust. However, as telecommunication operators migrated to cloud-native environments, this historical complacency mutated into a prolific source of security flaws. Cybersecurity researchers from Nanyang Technological University recently uncovered 84 previously unknown zero-day vulnerabilities across open-source 4G and 5G mobile core software implementations. Maintainers have already validated 83 of these findings, with 81 assigned official Common Vulnerabilities and Exposures (CVE) identifiers.
These architectural deficiencies were identified across seven prominent open-source mobile core implementations, including Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF. The vulnerabilities specifically target the GPRS Tunnelling Protocol Control Plane (GTP-C) and the Packet Forwarding Control Protocol (PFCP) – the foundational signaling mechanisms responsible for session establishment, data routing, and policy enforcement across internal network nodes.
The Anatomy of Implicit Trust Flaws
The root cause of these systemic defects stems not from isolated coding oversights, but rather from a flawed underlying trust model. Internal mobile core components habitually presume that control messages originating from neighboring nodes are intrinsically legitimate. Consequently, software stacks frequently neglect to validate mandatory fields, payload lengths, permissible parameter bounds, or resource allocation limits. This lax design ethos emerged during an era when internal telecom interfaces operated within physically isolated infrastructures, far removed from public network exposure.
Cloud Migration and Perimeter Dissolution
Cloud-native deployments have dramatically eroded these legacy perimeter boundaries. Network misconfigurations or inadequate tenant isolation can inadvertently expose sensitive internal signaling interfaces to external threat actors. In certain instances, malicious control packets can be encapsulated within standard user plane traffic and funneled through a base station directly into the core network architecture.
Taxonomy and Exploitation Dynamics
The research team categorized this vulnerability class as “implicit trust flaws.” Among the 84 uncovered defects, the most prevalent pattern involved software components expecting mandatory information elements without verifying their actual presence. Other flaws permitted adversaries to inject malformed values, corrupt connection states, or exhaust internal memory pools and control objects. Consequently, targeted network functions suffered complete denial-of-service (DoS) crashes, ceasing response capabilities.
Automated Vulnerability Discovery via iFinder
To systematically uncover these hidden flaws, researchers engineered an advanced, LLM-powered multi-agent framework named iFinder. Detailed in their NTU research paper on 5G security, the system first extracts recurring patterns from known historical flaws, analyzes source code, and cross-references suspicious code logic against official 3GPP technical specifications. Subsequently, iFinder automatically synthesizes proof-of-concept exploit code, executes it within a controlled testbed, and iteratively refines payloads based on runtime logs until the vulnerability is empirically confirmed.
Benchmarking LLM Precision in Code Auditing
When evaluated purely as a standalone code auditor without domain-specific specification grounding, the large language model suffered from excessive false positives. However, by validating code execution against 3GPP standards and real-time trial runs, iFinder’s precision surged dramatically from 28% to 75%. Overall, the automated system successfully identified approximately 68% of previously known benchmark vulnerabilities used for validation.
Session Hijacking in Commercial 5G Implementations
The most perilous finding involved a critical session-hijacking vector. An attacker could transmit a forged PFCP request that injected a forwarding rule with a higher priority than a legitimate subscriber’s configuration. The user plane function (UPF) processing the traffic accepted the duplicate rule identifier without validation, rerouting the victim’s outbound data traffic directly to the adversary rather than the public internet.
Commercial Vendor Disclosures and Patch Status
The researchers successfully reproduced this session-hijacking attack not only in open-source stacks but also across two commercial 5G core implementations running default configurations. One vendor has addressed the issue under CVE-2026-8233 (CVSS 4.6 Medium), while the second vendor is actively preparing a patch. Another confirmed vulnerability in a commercial system, assigned CVE-2026-8232 (CVSS 3.5 Low), allowed remote attackers to trigger a denial-of-service state.
Architectural Recommendations for Telecom Security
The authors advise mobile network operators to abandon absolute trust models within the cellular core. Operators must enforce strict micro-segmentation between network functions and restrict unnecessary access to internal management interfaces. Furthermore, developers must rigorously validate the structure, bounds, and semantic logic of every incoming message, prohibit duplicate rule identifiers, and enforce strict resource quotas to ensure malformed requests trigger graceful rejections rather than catastrophic service collapse.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
