CVE-2026-44473 Overview
Ella Core is an open-source 5G core designed for private networks. CVE-2026-44473 allows a malicious radio with a valid NG Setup to send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core fails to verify the message arrived on the Stream Control Transmission Protocol (SCTP) association bound to that UE's logical NG-connection. The core then creates a GTP tunnel toward the attacker-controlled radio. The flaw is fixed in version 1.10.0. The weakness is classified as [CWE-358] Improperly Implemented Security Check for Standard.
Critical Impact
An adjacent attacker operating a rogue gNB can hijack user-plane tunnels of arbitrary UEs, disrupting connectivity and redirecting subscriber traffic.
Affected Products
- Ella Core versions prior to 1.10.0
- Ella Networks 5G core deployments serving private networks
- Any NG-RAN deployment exposing the N2 (NGAP) interface to untrusted radios
Discovery Timeline
- 2026-05-27 - CVE-2026-44473 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44473
Vulnerability Analysis
The vulnerability resides in how Ella Core processes NGAP messages received from connected radios. The 3GPP NGAP protocol uses SCTP associations between each gNB and the Access and Mobility Management Function (AMF). Each UE context is logically bound to the SCTP association of the gNB serving it. When a PDUSessionResourceSetupResponse arrives, Ella Core trusts the AMF-UE-NGAP-ID field in the message without validating that the SCTP association matches the one bound to that UE's NG-connection. A radio with a valid NG Setup can therefore impersonate sessions belonging to UEs served by other radios.
Root Cause
The root cause is a missing security check tying NGAP message identifiers to their authenticated transport. Ella Core treats the AMF-UE-NGAP-ID as authoritative without cross-checking the originating SCTP association against the UE's registered NG-connection. This breaks a standard mandated by 3GPP TS 38.413 and reflects [CWE-358].
Attack Vector
Exploitation requires adjacent network access and a gNB that completes a valid NG Setup with Ella Core. The attacker crafts a PDUSessionResourceSetupResponse containing the AMF-UE-NGAP-ID of a victim UE attached through a different radio. Upon processing, Ella Core establishes a GTP-U tunnel toward the attacker's gNB rather than the legitimate one. The result is denial of service for the victim UE and potential redirection of its user-plane traffic. No authentication beyond the initial NG Setup is required, and no user interaction is involved.
See the GitHub Security Advisory GHSA-qfxw-v8qx-vj3v for protocol-level details.
Detection Methods for CVE-2026-44473
Indicators of Compromise
- Unexpected PDUSessionResourceSetupResponse messages referencing AMF-UE-NGAP-IDs not associated with the originating SCTP association
- GTP-U tunnels established toward gNBs that do not serve the corresponding UE according to AMF state
- UE connectivity loss correlated with the appearance of a new or recently registered gNB on the N2 interface
Detection Strategies
- Correlate NGAP message identifiers with the source SCTP association on the AMF and alert on mismatches
- Audit Ella Core logs for PDUSessionResourceSetupResponse handling events and compare UE-to-gNB bindings against AMF context state
- Monitor the rate of NG Setup completions and downstream PDU session activity from newly connected radios
Monitoring Recommendations
- Capture and inspect NGAP traffic on the N2 interface for anomalous AMF-UE-NGAP-ID reuse across associations
- Track GTP tunnel creation events and validate the downstream peer matches the radio currently serving the UE
- Alert on user-plane traffic redirection patterns or sudden UE session interruptions following NGAP activity
How to Mitigate CVE-2026-44473
Immediate Actions Required
- Upgrade Ella Core to version 1.10.0 or later, which enforces SCTP association binding for NGAP messages
- Restrict the N2 interface to trusted radios using network segmentation and IPsec where supported
- Review NG Setup records and remove any unauthorized or unrecognized gNB entries
Patch Information
The maintainers fixed the vulnerability in Ella Core 1.10.0. The patch enforces validation that incoming NGAP messages arrive on the SCTP association bound to the UE's logical NG-connection before acting on the AMF-UE-NGAP-ID. Patch details are published in the GitHub Security Advisory GHSA-qfxw-v8qx-vj3v.
Workarounds
- Limit N2/NGAP connectivity to authenticated, operator-controlled gNBs only
- Deploy IPsec with mutual authentication on the N2 interface to prevent rogue radios from completing NG Setup
- Continuously monitor NGAP traffic for AMF-UE-NGAP-ID reuse across distinct SCTP associations until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
