Full research report

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

NTU researchers used iFinder, an automated framework combining large language model analysis with code-specification cross-checking, to systematically identify a class of vulnerabilities caused by absent or inadequate input validation in 4G/5G core signalling handlers — yielding 84 flaws across seven open-source and two commercial implementations. The headline risk — session hijacking via duplicate PDR IDs in PFCP (CVE-2026-8233) — was confirmed on real commercial 5G networks and carries a CVSS v3 score of 4.6 against Dotouch XproUPF. Exploitation is non-trivial: an attacker must first reach internal CN signalling interfaces, either through misconfigured cloud deployments that expose PFCP or GTP-C endpoints to the internet, or by operating a malicious UE capable of smuggling crafted messages inside legitimate GTP-U tunnels. The researchers withheld exploit-grade PoC code and 58 of 83 open-source vulnerabilities had patches at publication, limiting near-term risk for diligent operators. The broader architectural significance is that cloud-native 5G deployments have eroded the physical isolation that historically protected these internal signalling interfaces, making the trust-without-validation design pattern a persistent and structurally rooted vulnerability class across the industry.

What happened

Researchers from Singapore's Nanyang Technological University (NTU) disclosed 84 previously unknown vulnerabilities across seven open-source 4G and 5G core network implementations and two commercial 5G cores, with findings to appear at USENIX Security Symposium 2026. The vulnerabilities, codenamed implicit trust errors (iTrues), share a single root cause: core network (CN) functions blindly trust signalling messages from internal peers without validating message format, semantics, or resource constraints across the GTP-C and PFCP protocols. Of the 84 findings, 83 were developer-confirmed and 81 assigned CVE identifiers; 58 of the open-source issues had patches available at the time of publication. A session-hijacking variant (CVE-2026-8233) was confirmed on two real commercial 5G core deployments, with one vendor patching and one still remediating.

Affected scope

Open-source LTE/5G core implementations: Open5GS (v2.4.14, v2.7.2, v2.7.5 for both LTE and 5G branches), free5GC (v2.0.2, v3.3.0), OpenAirInterface (LTE and 5G), SD-Core, and eUPF. Commercially: Dotouch XproUPF v2.0.0-release-088aa7c4 (CVE-2026-8233) and one unnamed 5G core vendor still in remediation. The attack surface spans the GTP-C and PFCP signalling protocols foundational to globally deployed 4G and 5G networks.

Technical assessment

The shared root cause is that CN functions accept and act on PFCP and GTP-C signalling messages without enforcing message-format validation, semantic checks, or resource-uniqueness constraints, trusting that internal network peers are well-behaved. In the headline session-hijacking case (CVE-2026-8233), a PFCP Session Modification Request bearing a duplicate Packet Detection Rule (PDR) ID with a higher-priority Precedence value causes the User Plane Function (UPF) to redirect a victim UE's uplink traffic to the attacker instead of the internet. In a DoS case (CVE-2026-8232), a malformed GTPv2-C Create Session Request crashes the Serving Gateway Control Plane (SGW-C), disrupting sessions for all connected UEs. Exploitation requires reaching internal CN signalling interfaces — either via internet-exposed endpoints resulting from cloud-native deployment misconfiguration, or by a malicious UE smuggling crafted PFCP/GTP-C payloads inside legitimate GTP-U tunnels. The cloud-to-telco transition is what renders previously physical-isolation-protected interfaces newly reachable.

Recommended defensive actions

  1. Patch all affected open-source CN implementations without delay; 58 of 83 open-source CVEs have fixes available — verify each deployment's patch status for Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF against the NTU research CVE list.
  2. Audit cloud-native 5G core deployments for misconfigurations that expose PFCP and GTP-C signalling interfaces to untrusted or internet-routable networks; apply strict firewall rules and network segmentation to restrict access to internal CN signalling planes.
  3. Upgrade or seek vendor remediation guidance for all Dotouch XproUPF deployments affected by CVE-2026-8233 (v2.0.0-release-088aa7c4); confirm remediation status with the vendor directly if patch release dates are unknown.
  4. Monitor for anomalous PFCP Session Modification Requests containing duplicate PDR IDs, unexpected SGW-C or UPF process crashes, and abnormal uplink traffic-forwarding rules in the UPF as indicators of attempted exploitation.
  5. Subscribe to security advisories from the maintainers of Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF to track remediation of the remaining ~25 unpatched open-source vulnerabilities as fixes are released.

Uncertainties and evidence gaps

  • The complete list of 81 CVE identifiers is not enumerated in the publicly available arXiv paper; only CVE-2026-8232 and CVE-2026-8233 are named explicitly in the text, leaving the full CVE-to-implementation mapping inaccessible without the paper's Table 4.
  • The second commercial 5G core vendor affected by the session-hijacking class is unnamed and remains in remediation; the scale of affected deployments and remediation timeline are unknown.
  • No assessment is available on whether any of the 84 flaws affect proprietary or carrier-grade commercial 5G core products beyond the two tested by the research team.
  • PFCP mutual authentication recommended in 3GPP Release 18 would mitigate a subset of these issues, but the proportion of real-world deployments that have adopted Release 18 features versus Release 16/17 is unknown.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork access to internal CN signalling interfaces — reachable via internet-exposed PFCP or GTP-C endpoints resulting from cloud-native deployment misconfiguration, or via a registered UE able to inject crafted payloads into uplink GTP-U traffic crossing the network boundary
ComponentGTP-C and PFCP signalling handlers in core network functions, specifically the Serving Gateway Control Plane (SGW-C) for denial-of-service and the User Plane Function (UPF) for session hijacking
MechanismCN functions accept and process signalling messages without validating message format, enforcing semantic constraints, or checking resource uniqueness, trusting that internally received messages are well-formed and authorised
ImpactDenial of service via SGW-C process crash disrupting sessions for all connected UEs; or session hijacking redirecting a victim UE's uplink traffic to an attacker-controlled endpoint
DetectionUnexpected PFCP or GTP-C messages arriving from unauthorised source addresses; repeated SGW-C or UPF process crashes; anomalous traffic-forwarding rules in UPF exhibiting duplicate PDR IDs or unexpected Precedence values
MitigationApply available patches for each affected open-source implementation; upgrade Dotouch XproUPF past affected version 2.0.0-release-088aa7c4; enforce strict network boundary controls to prevent internal PFCP and GTP-C interface exposure to untrusted networks
Exploitation status

No confirmed active exploitation in the wild; researchers withheld exploit-grade proof-of-concept code pending patch deployment across affected implementations; exploitation requires attacker access to internal CN signalling interfaces via misconfigured cloud exposure or via a malicious UE smuggling crafted PFCP or GTP-C messages inside GTP-U tunnels.

Research process

The investigation began with a secondary news article describing 84 vulnerabilities across 4G and 5G core networks. Fetching both the primary news source and the underlying arXiv research paper confirmed the scope, affected product versions, exploitation conditions, and patch status. CVE-level detail was independently obtained from a third-party vulnerability database, establishing the specific session-hijacking CVE's CVSS score, commercial product identity, and disclosure timeline. A search for government advisories found no CISA or equivalent response, and no dark-web chatter or active exploitation evidence was identified — consistent with the researchers' responsible-disclosure approach of withholding exploit-grade proof-of-concept code.

  1. What are the scope, affected products, and technical details of the disclosed vulnerabilities as reported by the primary news outlet?
    Fetched The Hacker News article on the 84-flaw disclosure
    thehackernews.com ↗

    84 vulnerabilities across 7 open-source 4G/5G core implementations; root cause is implicit trust in GTP-C and PFCP signalling; CVE-2026-8233 named for session hijacking; iFinder LLM-assisted framework used for discovery; exploitation requires access to internal CN interfaces.

    why Established the event scope, affected implementations and protocols, exploitation preconditions, and provided leads to the original research paper.

  2. What does the original research paper confirm about methodology, affected product versions, CVE assignments, and patch status?
    Searched for and fetched the arXiv abstract for the NTU paper (arXiv 2607.10315)
    arxiv.org ↗

    Paper by Ziyu Lin et al. (NTU); 84 vulnerabilities found, 83 confirmed, 81 CVEs assigned; session-hijacking confirmed on real commercial 5G network; accepted at USENIX Security Symposium 2026.

    why Primary-source confirmation of the research scope, independent of the secondary news article, establishing the academic credibility and peer-review status of the findings.

  3. What specific CVE identifiers, product versions, PoC availability, and patch rates does the full paper document?
    Fetched the full arXiv HTML version of the paper
    arxiv.org ↗

    CVE-2026-8232 (DoS) and CVE-2026-8233 (session hijacking) are the two named commercial CVEs; tested versions include Open5GS v2.4.14/v2.7.2/v2.7.5 and free5GC v2.0.2/v3.3.0; 58 of 83 open-source vulnerabilities patched at publication; exploit-grade PoC code withheld; iFinder framework and dataset available on Zenodo.

    why Provided primary-source confirmation of patch rates, specific CVE identifiers, affected versions, and the responsible-disclosure decision not to release weaponisable code — key inputs to the exploitation and defensive-action assessments.

  4. What is the CVSS severity, exact affected product, and official record status of CVE-2026-8233?
    Fetched the Tenable CVE record for CVE-2026-8233
    tenable.com ↗

    CVE-2026-8233 affects Dotouch XproUPF v2.0.0-release-088aa7c4; CVSS v3 score 4.6 Medium; published May 2026, last updated July 2026; responsible disclosure confirmed; no patch documented on the CVE record page itself.

    why Independently confirmed the commercial product identity, severity classification, and disclosure timeline for the headline CVE, distinct from the research paper's account.

  5. Have CISA or other government bodies issued advisories or alerts on these 5G core vulnerabilities?
    Searched for CISA or government advisories covering GTP-C and PFCP vulnerabilities in 5G core networks in 2026

    No CISA or equivalent government advisory found specifically addressing the NTU 84-flaw disclosure; CISA maintains a general 5G Security and Resilience topic page but it does not reference this research.

    why Absence of a government advisory means defenders must rely on vendor patch notices and the research paper directly; this is a gap in the defensive landscape worth flagging.

  6. Are there independent patch advisories or additional CVE disclosures from the affected open-source project maintainers?
    Searched for security advisories from Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF, and fetched the SentinelOne record for CVE-2026-44317 (free5GC)
    sentinelone.com ↗

    Several free5GC CVEs appeared in results (CVE-2026-44317, CVE-2026-40248, CVE-2026-33192); free5GC v4.2.2 patches CVE-2026-44317 (nil pointer dereference in PCF). However, these cannot be confirmed as part of the NTU 84-flaw study from fetched sources.

    why Indicates active patching across affected open-source projects, but the exact correspondence of these CVEs to the 84-flaw list is unverifiable without the paper's full CVE table, warranting conservative inclusion.

Named in this story
TargetsMobile network operators running cloud-native 4G/5G coresOpen-source 5G/LTE testbed deployments (Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF)Dotouch XproUPF commercial deploymentsUnnamed second commercial 5G core vendor still in remediation
Related CVEs CVE-2026-8232CVE-2026-8233

Research coverage

All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1656 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok669 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1006 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 7 opened outside the registered collection
References & evidence
PoC & exploit code2
Understanding Implicit Trust Errors in Core Carrier Networks – arXiv 2607.10315 (full HTML) arxiv.org ↗

Primary research paper containing technical PoC scenarios for DoS and session-hijacking attack chains; exploit-grade code withheld by authors.

Understanding Implicit Trust Errors in Core Carrier Networks – arXiv 2607.10315 (abstract) arxiv.org ↗

Citable arXiv entry; iFinder framework and ground-truth vulnerability dataset linked to Zenodo from this page.

Vendor & gov advisories1
CVE-2026-8233 – Dotouch XproUPF Improper Access Control (Tenable) tenable.com ↗

CVE record for the headline session-hijacking flaw; CVSS v3 4.6 Medium; affects Dotouch XproUPF v2.0.0-release-088aa7c4; published May 2026, updated July 2026.

Analysis & research2
Understanding Implicit Trust Errors in Core Carrier Networks (USENIX Security 2026) – arXiv arxiv.org ↗

Peer-reviewed primary source by Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong, XiaoFeng Wang (NTU); to appear at USENIX Security Symposium 2026.

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw – The Hacker News thehackernews.com ↗

Accessible secondary coverage providing a clear account of exploitation conditions and affected implementations.