Researchers Uncover 84 Security Flaws in 4G/5G Core Networks, Enabling Session Hijacking and DoS
A new academic study has identified 84 vulnerabilities in 4G and 5G core networks, stemming from implicit trust errors, which could allow attackers to hijack user sessions and launch denial-of-service attacks.
Academics from Nanyang Technological University have disclosed a significant class of security vulnerabilities affecting the core networks of 4G and 5G cellular systems. These flaws, dubbed 'implicit trust errors' (iTrue), could empower attackers to conduct denial-of-service (DoS) attacks and, more critically, hijack user sessions, potentially granting them unauthorized control over network access.
The research, detailed in the paper "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis," focused on the signaling interfaces of LTE/5G core networks. The study examined two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF), analyzing two key signaling protocols: GTP-C and PFCP.
The core issue identified is a pervasive implicit trust between different network functions. Historically, cellular core networks relied on physical isolation to maintain a trusted zone. However, the shift towards cloud-native deployments has made this trust model fragile, expanding the attack surface and potentially exposing interfaces that were once considered internal and secure. This inherent trust, combined with weaknesses in interface validation, creates an exploitable pathway for malicious actors.
To systematically discover these vulnerabilities, the researchers developed an LLM-assisted multi-agent system named iFinder. This system summarizes known flaws, categorizes them, and uses this knowledge to identify new iTrues within core network implementations. The process involves detecting weaknesses in message format, semantics, and resource availability checks, where network components blindly trust messages from peers.
After initial discovery, iFinder employs a code-specification cross-checking technique to eliminate false positives. Subsequently, an LLM-driven approach generates and refines proof-of-concept (PoC) exploits by executing them against the target implementations. This rigorous methodology led to the identification of 84 previously unknown vulnerabilities across the tested open-source LTE/5G core networks, with 83 confirmed and 81 assigned CVE identifiers.
Notably, some of the identified flaws in 5G systems appear to be inherited from their 4G predecessors, highlighting how security risks can persist across generations and how legacy designs can introduce new concerns when adapted to modern deployments. The researchers demonstrated how a duplicate Packet Detection Rule ID in PFCP Session Modification Request messages could be exploited for session hijacking, allowing an attacker to redirect a victim's traffic.
Successful exploitation of these iTrue flaws, whether for DoS or session hijacking, requires the attacker to first obtain the IP addresses of core network components. This can be achieved through public documentation, network scanning, or by exploiting misconfigurations in cloud deployments. Attackers can be remote or even malicious User Equipment (UE) devices that inject crafted payloads into the uplink data stream, often by smuggling PFCP or GTP-C messages within GTP-U messages.
The implications of these findings are substantial, as core network vulnerabilities can impact millions of users and critical infrastructure. The study underscores the need for enhanced security practices in the design and deployment of cellular networks, particularly as they evolve towards more complex, cloud-native architectures. Addressing implicit trust errors and strengthening interface validation are crucial steps in securing the future of mobile communication.