CVE-2026-44473-nvd.nist.gov-Received

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying …

Published:

26 May 2026 at 22:00:00

Alert date:

27 May 2026 at 18:07:10

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure, Critical Infrastructure

Ella Core, a 5G core platform for private networks, contains a vulnerability prior to version 1.10.0 that allows attackers with valid NG Setup to forge PDUSessionResourceSetupResponse messages carrying arbitrary UE AMF-UE-NGAP-IDs. The system fails to verify that messages arrive on the correct SCTP association bound to the UE's logical NG-connection, enabling unauthorized GTP tunnel creation. This authentication bypass vulnerability affects 5G private network infrastructure and has been patched in version 1.10.0.

Technical details

Mitigation steps:

Affected products:

Ella Core