Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
Researchers have uncovered 84 security vulnerabilities in 4G and 5G core networks, stemming from "implicit trust errors" that could enable denial-of-service attacks and session hijacking.
Intelligence analysis by Gemini 2.5 Flash
A study by Nanyang Technological University identified a widespread class of security flaws in LTE/5G core networks, particularly in open-source implementations. These vulnerabilities arise from components blindly trusting internal peers, a weakness exacerbated by the shift to cloud-native deployments, expanding the attack surface for malicious actors.
Imagine your phone network is like a big office building, and all the different departments trust each other completely, even if someone sends a suspicious message. Researchers found 84 secret back doors in this building where tricky people could sneak in to crash the system or even pretend to be you on your phone, all because the departments weren't checking messages carefully enough.
Analysis
The Pervasive Threat of Implicit Trust Errors
An academic study has brought to light a significant class of security vulnerabilities, dubbed "implicit trust errors" (iTrue), that are deeply embedded within 4G and 5G core networks. These flaws stem from a fundamental design issue where core network functions implicitly trust messages received from internal peers without adequate validation of format, semantics, or resource availability. Historically, cellular core networks relied on physical isolation to maintain a secure trust zone between components. However, the modern transition to cloud-native deployments has rendered this traditional trust model fragile, inadvertently expanding the attack surface and allowing external adversaries to potentially reach previously internal interfaces. This blind trust, coupled with interface weaknesses, creates a fertile ground for malicious activities.
iFinder: An LLM-Assisted Discovery
To systematically identify and understand the consequences of these iTrue flaws, the researchers developed an innovative large language model (LLM)-assisted multi-agent system named iFinder. This system is designed to summarize known flaws, categorize them into detection patterns, and then leverage this knowledge to discover new vulnerabilities in core network implementations. iFinder employs a novel code-specification cross-checking technique to weed out hallucinations and false positives, followed by an LLM-driven approach to generate and iteratively refine proof-of-concept exploits. Running iFinder against seven open-source 4G and 5G core network implementations (including Open5GS, OpenAirInterface, and free5GC) led to the discovery of 84 previously unknown vulnerabilities. Of these, 83 have been confirmed, and 81 have already been assigned CVE identifiers, underscoring the severity and widespread nature of the findings. Notably, some 5G flaws were inherited from their 4G counterparts, illustrating how security risks can persist across generations.
Exploitation Pathways and Consequences
The identified iTrue flaws could be exploited to launch severe attacks, including denial-of-service (DoS) and session hijacking. Successful exploitation, however, requires specific prerequisites: an adversary must obtain the IP addresses of core network components (e.g., via public documentation or scanning) and gain access to internal core network interfaces, often by exploiting misconfigurations in cloud deployments. Attackers, whether remote or malicious User Equipment (UE), could smuggle crafted Packet Forwarding Control Protocol (PFCP) or GPRS Tunnelling Protocol Control Plane (GTP-C) messages inside GTP-U messages. This allows them to bypass boundary enforcement and deliver malicious payloads to core network components. For instance, a DoS attack against Open5GS LTE could crash the Serving Gateway Control plane (SGW-C) by sending malformed GTPv2-C messages. Session hijacking could involve an attacker reusing a victim's Packet Detection Rule (PDR) ID with a higher priority, redirecting the victim's uplink traffic to a malicious forwarding tunnel.
Key points
- Researchers identified 84 security vulnerabilities, termed "implicit trust errors" (iTrue), in 4G and 5G core networks.
- These flaws stem from core network components blindly trusting internal peers, a weakness exacerbated by cloud-native deployments.
- The vulnerabilities could enable denial-of-service (DoS) attacks and session hijacking.
- An LLM-assisted multi-agent system called iFinder was developed to discover and analyze these flaws.
- 81 of the discovered vulnerabilities have been assigned CVE identifiers, highlighting their severity.
The detailed discovery and analysis of these 84 vulnerabilities provide a crucial opportunity for mobile network operators and vendors to develop and deploy necessary patches. This proactive identification, aided by advanced tools like iFinder, can significantly enhance the security posture of 4G and 5G networks, safeguarding user data and ensuring service integrity.
Should these implicit trust errors remain unaddressed, the potential for widespread denial-of-service attacks and sophisticated session hijacking is substantial. Such exploits could lead to significant disruptions in mobile communication, compromise sensitive user information, and erode public trust in next-generation cellular technologies.
