A newly published academic study has revealed a significant number of previously unknown security weaknesses affecting modern 4G LTE and 5G core networks, raising concerns about the security of mobile infrastructure used worldwide. Researchers identified 84 vulnerabilities across several widely deployed LTE and 5G core network implementations, including flaws that could allow attackers to launch denial-of-service (DoS) attacks or even hijack active user sessions.
The findings were published by researchers from Nanyang Technological University (NTU) Singapore in a study examining trust-related weaknesses within carrier-grade mobile network infrastructures. At the heart of the issue is a recurring security problem the researchers call Implicit Trust Errors (iTrues), where critical network components automatically trust messages received from other internal systems without sufficient validation.
A Common Root Cause Across Mobile Core Networks
The research analyzed seven popular open-source cellular core network platforms, including multiple LTE and 5G implementations such as:
- Open5GS
- OpenAirInterface
- free5GC
- SD-Core
- eUPF
The vulnerabilities were found across key mobile-network signaling protocols, including:
- GPRS Tunneling Protocol-Control Plane (GTP-C)
- Packet Forwarding Control Protocol (PFCP)
Researchers discovered that many network functions blindly accepted and acted upon commands from internal peers, assuming that every component operating within the network could be trusted.
Historically, this architecture was considered acceptable because cellular core networks were isolated from public access. However, the transition toward cloud-native and virtualized telecom infrastructures has significantly expanded the attack surface, making previously protected interfaces more accessible and exposing weaknesses in long-standing trust assumptions.
AI-Assisted Vulnerability Discovery
To identify these flaws, the researchers developed an advanced multi-agent security analysis platform called iFinder.
The system uses large language models (LLMs) to:
- Analyze known vulnerabilities
- Identify recurring attack patterns
- Examine protocol specifications
- Compare implementation behavior against expected standards
- Generate and test proof-of-concept attack scenarios
The researchers then validated findings through code analysis and runtime testing to eliminate false positives and confirm actual security weaknesses.
Using this approach, the team uncovered 84 previously undocumented vulnerabilities, with 83 already confirmed and 81 assigned CVE identifiers.
Security Risks Inherited From Previous Generations
One particularly concerning finding was that several vulnerabilities discovered in modern 5G systems appear to have been inherited from older 4G LTE architectures.
This suggests that certain security weaknesses have persisted across multiple generations of mobile network technology. As telecom providers migrated legacy designs into cloud-native environments, old trust assumptions remained unchanged even though the operational landscape evolved dramatically.
The result is a class of vulnerabilities that may not have posed significant risks in physically isolated environments but become far more dangerous in modern distributed and virtualized deployments.
Potential Impact: Denial-of-Service and Session Hijacking
Researchers found that successful exploitation could enable attackers to:
- Crash core network components
- Disrupt mobile services
- Interfere with subscriber connectivity
- Redirect user network traffic
- Hijack active sessions
The most serious of these findings involves session hijacking, where an attacker can potentially take control of a victim's traffic flow inside the mobile network.
To perform the attack, an adversary would first need knowledge of certain core network component IP addresses, gain access to internal signaling interfaces, and exploit configuration weaknesses that expose trusted network functions.
Once those prerequisites are met, the attacker can abuse PFCP signaling controls to manipulate network forwarding rules inside the User Plane Function (UPF).
How the Session Hijacking Attack Works
Researchers demonstrated that an attacker could inject malicious PFCP modification requests into a vulnerable 5G environment.
The process involves:
- Establishing communication with the User Plane Function.
- Waiting for a legitimate subscriber session to be established.
- Issuing malicious PFCP modification commands.
- Replacing legitimate packet forwarding rules with attacker-controlled rules.
- Creating a new tunnel between the victim's network session and attacker-controlled infrastructure.
Once successful, the victim's network traffic is forwarded through systems controlled by the attacker instead of its intended destination.
In practical terms, this would allow an attacker to intercept, monitor, or manipulate a subscriber's network communications.
Real-World 5G Networks Affected
The session hijacking vulnerability was not limited to laboratory testing environments.
Researchers confirmed the flaw in two commercial 5G core network deployments.
One identified vendor, Dotouch, has already addressed the issue in its XproUPF product and assigned the vulnerability CVE-2026-8233.
A second major commercial 5G provider, whose identity has not been publicly disclosed, is reportedly still working on remediation efforts.
Denial-of-Service Scenarios
Beyond session hijacking, researchers also demonstrated denial-of-service attacks against vulnerable implementations.
For example, in one Open5GS LTE scenario, specially crafted GTP-C session establishment messages could trigger a flaw in the Serving Gateway Control Plane (SGW-C), causing the service to crash.
A successful attack could disrupt subscriber connectivity and potentially impact large numbers of users connected to affected infrastructure.
Attack Complexity and Required Conditions
The researchers emphasized that exploitation is not trivial.
Successful attacks generally require one or more of the following conditions:
- Misconfigured cloud deployments
- Exposure of internal core network interfaces
- Insufficient network segmentation
- Access to internal signaling protocols
- Malicious subscriber equipment connecting to the network
The study also explored scenarios where attackers could tunnel malicious PFCP and GTP-C messages inside legitimate GTP-U traffic streams, allowing crafted packets to cross network boundaries that should ordinarily prevent direct access to core systems.
By exploiting weaknesses in boundary enforcement, these packets may be delivered and processed by critical network functions that were never intended to receive them from external sources.
A Growing Industry-Wide Problem
Researchers believe the findings point to a much broader security challenge rather than isolated implementation mistakes.
The discovery of dozens of similar vulnerabilities across multiple vendors and platforms suggests that implicit trust models remain deeply embedded throughout cellular infrastructure.
As mobile operators continue adopting cloud-native 5G architectures, these trust assumptions become increasingly risky.
According to the researchers, the sheer number of discovered vulnerabilities indicates that telecom vendors and network operators must move beyond patching individual flaws and instead rethink the foundational trust relationships that exist between cellular core network components.
Conclusion
The discovery of 84 vulnerabilities across 4G and 5G core networks highlights an emerging security challenge facing the telecommunications industry. Many of the flaws stem from a shared design issue in which critical network functions assume that internal communications can be trusted without sufficient verification.
While exploiting these weaknesses often requires specific conditions, the potential consequences including service disruption, traffic interception, and session hijacking demonstrate the importance of strengthening security controls around core network interfaces. As telecom infrastructures become increasingly cloud-based and interconnected, addressing these implicit trust weaknesses will be essential to protecting next-generation mobile networks.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
