Summary
- The research attributes the flaws to implicit trust between cellular-core components and incomplete validation of internal messages.
- Eighty-three findings were confirmed, 81 received CVE identifiers, and 58 had been fixed when the paper was prepared.
- Session hijacking was reproduced in two commercial 5G core test environments, with one vendor still carrying out remediation.
Researchers have identified 84 previously unknown vulnerabilities across seven open-source cellular-core implementations, exposing how trust assumptions inherited from physically isolated telecoms networks can fail in cloud-native deployments.
The research paper, which is due to appear at the USENIX Security Symposium, describes a recurring class of weakness called an implicit trust error.
These flaws arise when one core-network component assumes that messages arriving from another internal function are legitimate and safe to process. Implementations may omit syntax checks, fail to enforce expected relationships between data fields, or allocate resources without confirming that sufficient capacity exists.
Such assumptions were formed when core interfaces were expected to operate inside a physically isolated and trusted environment. Network virtualisation and cloud-native deployment weaken that boundary by distributing functions across software platforms, containers, and shared infrastructure.
The researchers used an artificial-intelligence-assisted system named iFinder to analyse known flaws, extract recurring patterns, compare potential findings with source code and 3GPP specifications, and generate proof-of-concept tests inside controlled environments.
Across seven open-source implementations, the system identified 84 previously unknown vulnerabilities affecting Packet Forwarding Control Protocol and GPRS Tunnelling Protocol Control Plane communications. Eighty-three were confirmed by developers, and 81 had received Common Vulnerabilities and Exposures identifiers.
At the time the paper was prepared, 58 of the 83 confirmed open-source findings had been fixed. The remaining status varied across the individual projects.
The potential effects included denial of service and session hijacking. The latter involved a failure to enforce uniqueness in packet-detection rule identifiers, allowing a malicious rule to take priority over a legitimate one and redirect a user’s uplink traffic.
The researchers reproduced the session-hijacking behaviour in two commercial 5G core environments using vendor-authorised evaluation units. One vendor had corrected the issue and received a CVE assignment, while the second was still carrying out remediation.
The work did not involve production operator networks, live subscribers, or real user data. Experiments were conducted in isolated testbeds or authorised vendor environments, and the paper presents no evidence that the vulnerabilities have been exploited against operational networks.
That distinction is important. The research confirms weaknesses in implementations and controlled commercial environments; it does not establish compromise of telecoms operators or subscribers.
The wider finding is architectural. Cellular cores consist of network functions exchanging signalling and subscriber information across internal interfaces. When each component assumes another has already validated a request, malformed or contradictory data can pass deeper into the system before producing a security failure.
Cloud-native deployment changes the environment surrounding those interfaces. Orchestration platforms, application programming interfaces, shared infrastructure, and rapid software updates improve flexibility, but they also create more paths through which an exposed or compromised component might reach a service previously considered internal.
The paper assumes an attacker can reach core-network components through circumstances such as cloud misconfiguration. Reachability is therefore a prerequisite for the demonstrated attacks rather than an automatic condition in every deployment.
For European telecoms operators, the findings intersect with ongoing 5G deployment, cloud migration, supplier oversight, and resilience obligations. A core-network failure can affect authentication, subscriber sessions, or service availability at a scale far beyond an individual device.
The research also shows how open-source analysis can reveal patterns relevant to proprietary products. The tested commercial systems contained the same session-hijacking root cause found in an open implementation, despite being developed and operated separately.
The individual vulnerabilities can be addressed through patches and vendor remediation. The more persistent issue is whether internal network functions continue to rely on trust established for an architecture that cloud-native deployment has already changed.
