Study finds 84 implicit-trust flaws in 4G and 5G cores

Researchers at Singapore's Nanyang Technological University found 84 previously unknown flaws in seven open-source 4G and 5G core implementations. The study tested Open5GS and OpenAirInterface for LTE, plus those two, free5GC, SD-Core and eUPF for 5G, using GTP-C and PFCP. Of the flaws, 83 are confirmed and 81 have CVE identifiers.

Implicit trust expands the attack surface

Cellular cores historically used physical isolation to keep interfaces within a trust zone. Cloud-native deployment makes that model fragile when misconfiguration exposes internal signaling interfaces.

The researchers call the pattern implicit trust errors, or iTrues. Core functions may accept peer messages without validating format, semantics, resources or uniqueness, enabling denial of service or session hijacking.

How exploitation works

Exploitation requires discovering a core IP address, reaching an internal interface and sending arbitrary PFCP or GTP-C messages. Remote actors or malicious User Equipment may smuggle them inside GTP-U when boundaries are weak.

An Open5GS LTE flaw lets GTPv2-C Create Session Request messages crash the Serving Gateway Control plane. For hijacking, an attacker reuses the victim's Packet Detection Rule ID in a PFCP Session Modification Request, gives it higher priority and binds it to a malicious Forwarding Action Rule.

If the User Plane Function accepts the duplicate, it matches the attacker's rule first and forwards the victim's uplink traffic through a new tunnel to the attacker instead of the internet.

Validation and commercial impact

iFinder uses an LLM-assisted multi-agent workflow to derive detection patterns and find candidates. Code-specification cross-checking verifies whether each protocol procedure enforces validation and resource checks. Proof-of-concept exploits are then generated, run and refined against the implementations.

The session hijacking flaw was also found in two commercial 5G cores. Dotouch fixed XproUPF as CVE-2026-8233, with a CVSS score of 4.6; an unnamed major 5G carrier remained in remediation.

Business implication

Operators should not trust core signaling merely because it was designed for isolation. Restrict PFCP and GTP-C reachability, enforce boundaries, test validation controls and verify fixes in deployed builds.