84 flaws uncovered in global 4G and 5G core networks

Researchers at Singapore’s Nanyang Technological University have disclosed 84 previously unknown security flaws in the cores of 4G and 5G networks, warning that the weaknesses could enable denial-of-service attacks and, in some cases, full session hijacking against mobile subscribers.^[2][4] The team analyzed seven open-source core implementations and confirmed that 83 of the bugs were acknowledged by maintainers, with 81 already assigned CVE identifiers in coordination with affected projects and vulnerability databases.^[1][2][4]

The vulnerabilities cluster in the Packet Forwarding Control Protocol (PFCP) and GPRS Tunnelling Protocol Control plane (GTP-C), which carry critical signaling traffic that steers data through LTE and 5G standalone cores.^[1][2] According to public write-ups of the work, many issues stem from missing input validation and improper handling of invalid or duplicate identifiers in session state, such as Packet Detection Rules used by user plane functions to route user traffic.^[1][2][8] In one highlighted pattern, a user plane function accepts a duplicate rule and silently reorders its forwarding table, allowing an attacker with access to the control interface to redirect a subscriber’s uplink traffic without their knowledge.^[1][2]

The researchers demonstrated both denial-of-service and traffic-hijacking impacts using crafted PFCP and GTP-C messages sent to vulnerable components.^[1][2] In lab tests, they report reproducing a session-hijacking flaw against two commercial 5G core products after first finding the issue in open-source software, showing that the weaknesses are not confined to community projects.^[2][3] Social media posts and secondary analyses emphasize that exploitation requires access to internal interfaces such as N4 or N6, but warn that misconfigured firewalls, containerized deployments and roaming interconnects increasingly expose those control-plane paths beyond their originally intended trust boundaries.^{[1][2][3][4][7]}

A separate summary of the work describes the flaws as a “widespread class” of vulnerabilities rooted in implicit trust between core network functions, made worse as operators adopt cloud-native architectures that scatter components across IP networks and data centers.^[1][4] The study underscores that, while 4G and 5G specifications were designed assuming tightly controlled internal links, many modern deployments now terminate PFCP and GTP-C on virtual machines or containers reachable from shared infrastructure, expanding the blast radius if a single component is compromised.^[1][2][4]

Although the new bugs span a different code base, the findings echo previous telecom research that uncovered more than 100 flaws in LTE and 5G core implementations and multiple weaknesses in commercial packet cores such as Microsoft’s Azure Private 5G Core.^[10][11][13] Recent advisories for software like Open5GS, including denial-of-service and authentication issues tracked under various CVE identifiers, further illustrate that mobile core stacks remain a rich target for attackers and an ongoing patching burden for operators.^[9][12]

For operators, the immediate priority is to track advisories from affected open-source projects, apply patches as they become available, and verify that any PFCP and GTP-C endpoints are strictly segmented from untrusted networks, including customer-facing and roaming links. Security teams should add deep packet inspection or protocol-aware firewalling for PFCP, GTP-C and GTP-U where feasible, monitor for anomalous control-plane messages that could indicate fuzzing or exploitation attempts, and treat internal 4G and 5G signaling paths with the same zero-trust assumptions now common for enterprise IT environments.

References

1. 84 New 5G Core Vulnerabilities — and Why This Is Just the Beginning
2. 84 New Flaws in Open-Source 4G and 5G Cores, 81 With …
3. “🛑 Researchers found 84 flaws across seven open-source 4G and 5G cores …
4. Researchers Report 84 Flaws in 4G and 5G Cores, Including …
7. Researchers Report 84 Flaws in 4G and 5G Cores …
8. Dmitry Kurbatov’s Post
9. Multiple vulnerabilities in Open5GS | INCIBE-CERT
10. Florida Institute for Cybersecurity Research – Cellular Security
11. Vulnerabilities in Cellular Packet Cores Part IV Authentication
12. CVE-2024-24430: Open5GS DoS Vulnerability via NAS Packet
13. RANsacked: Over 100 Security Flaws Found in LTE and 5G Network Implementations