84 Flaws Found in 4G and 5G Core Networks, Including Session Hijacking Vulnerability

Researchers from Singapore’s Nanyang Technological University have disclosed a widespread class of security vulnerabilities affecting 4G and 5G core networks. The study, titled “Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis,” identified 84 previously unknown flaws across seven open-source LTE/5G core implementations, including Open5GS, OpenAirInterface, free5GC, SD-Core, and eUPF. These vulnerabilities, rooted in implicit trust between core network functions, could enable denial-of-service (DoS) attacks and session hijacking, allowing attackers to intercept a user’s network traffic.

The researchers developed an LLM-assisted multi-agent system called iFinder to detect these implicit trust errors (iTrue). The system summarizes known flaws, categorizes them into detection patterns, and discovers new vulnerabilities. Of the 84 flaws found, 83 have been confirmed and 81 have been assigned CVE identifiers. The vulnerabilities stem from a lack of validation of message format, semantics, and resource availability, with core components blindly trusting messages from internal peers.

Attack scenarios require the adversary to obtain the IP address of core network components and access internal interfaces, potentially through misconfigurations in cloud deployments. The researchers demonstrated a session hijacking attack against a commercial 5G core network, where an attacker could inject a PFCP Session Modification Request to redirect a victim’s uplink traffic. One vendor, Dotouch, has patched the flaw in its XproUPF product (CVE-2026-8233, CVSS score: 4.6), while another unnamed major 5G carrier is still remediating.

The study highlights that these vulnerabilities are not isolated bugs but a systemic issue requiring urgent attention from vendors and network operators. The findings underscore the need for stronger trust boundaries and validation mechanisms in cellular core networks, especially as they transition to cloud-native architectures.