CVE-2026-33282: Ellanetworks Ella Core DoS Vulnerability

CVE-2026-33282 Overview

CVE-2026-33282 is a Null Pointer Dereference vulnerability in Ella Core, a 5G core network solution designed for private networks. The vulnerability exists in the NGAP (Next Generation Application Protocol) message handling component, where processing a malformed LocationReport message with a ue-presence-in-area-of-interest event type that omits the optional UEPresenceInAreaOfInterestList Information Element (IE) causes the application to panic and crash.

This vulnerability allows an unauthenticated attacker with network access to the Ella Core instance to send specially crafted NGAP messages that crash the process, resulting in complete service disruption for all connected 5G subscribers on the private network.

Critical Impact

Unauthenticated denial of service affecting all 5G network subscribers connected to the Ella Core instance. No user interaction required for exploitation.

Affected Products

• Ellanetworks Ella Core versions prior to 1.6.0
• All Ella Core deployments processing NGAP LocationReport messages
• Private 5G network installations using vulnerable Ella Core versions

Discovery Timeline

• 2026-03-24 - CVE-2026-33282 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33282

Vulnerability Analysis

The vulnerability resides in Ella Core's NGAP message processing logic, specifically when handling LocationReport messages. NGAP is the control plane protocol used between the 5G gNB (base station) and the 5G Core Network (5GC) Access and Mobility Management Function (AMF). LocationReport messages are used to report UE (User Equipment) location information to the core network.

When a LocationReport message arrives with the event type set to ue-presence-in-area-of-interest, the code expects to process the associated UEPresenceInAreaOfInterestList IE. However, according to 3GPP specifications, this IE is optional. When this IE is omitted from the message, the Ella Core application attempts to dereference a null pointer, triggering a panic condition that terminates the process.

The vulnerability is particularly severe in 5G private network environments because the core network component is critical infrastructure. A crash of the Ella Core process results in immediate service disruption for all connected devices and subscribers.

Root Cause

The root cause is a missing presence verification check for the optional UEPresenceInAreaOfInterestList Information Element before accessing it during LocationReport message processing (CWE-476: NULL Pointer Dereference). The code assumes the IE is always present when the event type indicates ue-presence-in-area-of-interest, without properly validating its existence first.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker needs network connectivity to the NGAP interface of the Ella Core instance, which typically communicates with gNBs on the N2 interface. The attacker crafts a malicious NGAP LocationReport message with the following characteristics:

• Event type set to ue-presence-in-area-of-interest
• The UEPresenceInAreaOfInterestList IE deliberately omitted from the message

When the Ella Core processes this malformed message, it attempts to access the missing IE, resulting in a null pointer dereference that crashes the application. Since NGAP operates over SCTP (Stream Control Transmission Protocol), the attacker would need to establish an SCTP association with the target, though no authentication at the NGAP layer is required.

The attack results in immediate process termination, affecting all subscribers currently connected to the private 5G network. Repeated attacks can prevent service restoration, creating a persistent denial of service condition.

Detection Methods for CVE-2026-33282

Indicators of Compromise

• Unexpected Ella Core process crashes or restarts in system logs
• NGAP LocationReport messages with ue-presence-in-area-of-interest event type but missing UEPresenceInAreaOfInterestList IE in packet captures
• Unusual SCTP connections to the N2 interface from unexpected source addresses
• Service disruption patterns indicating repeated crash-restart cycles

Detection Strategies

• Monitor Ella Core process stability and implement alerting on unexpected terminations
• Deploy NGAP-aware intrusion detection to identify malformed LocationReport messages
• Analyze SCTP traffic patterns for anomalous connection attempts to the N2 interface
• Implement application-level logging to capture NGAP message parsing failures

Monitoring Recommendations

• Configure process monitoring to alert on Ella Core crashes with automatic forensic data collection
• Enable detailed NGAP message logging to identify malformed messages before crashes occur
• Monitor network traffic on the N2 interface for suspicious patterns or unauthorized sources
• Implement health checks that detect service availability degradation across the 5G core

How to Mitigate CVE-2026-33282

Immediate Actions Required

• Upgrade Ella Core to version 1.6.0 or later immediately
• Restrict network access to the NGAP interface (N2) to only authorized gNBs
• Implement network segmentation to limit exposure of the 5G core components
• Deploy monitoring to detect exploitation attempts and rapid crash-restart patterns

Patch Information

Version 1.6.0 of Ella Core addresses this vulnerability by adding proper IE presence verification to NGAP message handling. Before processing LocationReport messages with ue-presence-in-area-of-interest event type, the patched version validates that the UEPresenceInAreaOfInterestList IE is present before attempting to access it, preventing the null pointer dereference condition.

For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement firewall rules to restrict NGAP interface access to trusted gNB IP addresses only
• Deploy an NGAP-aware proxy or gateway that validates message structure before forwarding to Ella Core
• Consider implementing automatic process restart with rate limiting to minimize downtime during attacks
• Monitor for crash events and implement automated incident response procedures

# Example: Restrict NGAP interface access to authorized gNBs only
# Replace with your actual gNB IP addresses
iptables -A INPUT -p sctp --dport 38412 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP