84 Flaws Found in Open-Source 4G and 5G Cores
Researchers at NTU Singapore found 84 flaws in open-source 4G/5G core software, enabling DoS and session hijacking via GTP-C and PFCP protocol weaknesses.
Loop Researchers at Nanyang Technological University Singapore identified 84 previously unknown vulnerabilities across the open-source implementations that carry 4G LTE and 5G standalone core traffic. Eighty-one have been assigned CVE identifiers. The study, titled “Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis,” was published this week and covered seven open-source implementations.
No active exploitation in the wild has been reported.
The protocols and what breaks
Two protocols anchor the findings: GPRS Tunnelling Protocol Control Plane (GTP-C), which moves control-plane signaling between core network gateways, and Packet Forwarding Control Protocol (PFCP), which separates user-plane packet routing from the control function in 5G’s disaggregated architecture.
DoS via GTP-C. Malformed GTPv2-C messages sent to a gateway control-plane component crash the target process. The component does not validate message structure before processing, meaning a network-accessible attacker can knock a gateway offline by replaying crafted control messages. No authentication is required for the crash.
Session hijacking via PFCP. An attacker sends a PFCP Association Setup Request directly to a User Plane Function. On affected implementations, this succeeds without mutual authentication. The attacker then injects Packet Detection Rules at higher priority than the existing forwarding table. Subscriber traffic is redirected to attacker-controlled endpoints. CVE-2026-8233 (CVSS 4.6, medium) documents one instance of this class in the Dotouch XproUPF implementation, per NVD.
The CVSS score reflects network access requirements and partial impact scope. In a carrier core context, redirecting subscriber sessions is operationally significant regardless of score.
Affected implementations
The researchers tested seven open-source projects:
| Stack | Implementations tested |
|---|---|
| 4G LTE | Open5GS, OpenAirInterface |
| 5G SA | Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF |
Not every CVE applies to every implementation. The paper covers vulnerability-to-implementation mapping; affected version ranges are in each project’s respective security advisory.
Why the isolation assumption fails now
Traditional carrier core networks ran on purpose-built hardware in physically isolated facilities. Reaching a GTP-C or PFCP interface required physical access to a carrier colocation cage. The implicit trust between core network functions — the root cause the researchers identify — was survivable because the attack surface was not reachable.
Cloud-native 5G deployments containerize these functions and run them on commodity Kubernetes clusters. The implicit trust is the same; the physical barriers that previously absorbed it are being removed. This mirrors the broader pattern documented in CISA’s recent warning on exposed PLC interfaces in water systems — infrastructure originally designed with physical separation as the primary control is being networked without compensating authentication requirements.
The CISA/ASD OT isolation guidance published last week puts the same principle more directly: isolation is a control, not just a topology preference, and its removal requires replacing it with something.
Remediation status
Dotouch has patched XproUPF. One unnamed major 5G carrier is still working through remediation. The open-source projects are in varying states; each project’s security tracker is the authoritative source on patch availability.
What to check
If you operate open-source 4G/5G core implementations: Confirm patch status against each upstream project’s security advisory. Treat control-plane interface exposure — GTP-C and PFCP endpoints — as the primary risk perimeter, not just the radio access network edge. These interfaces should not be reachable from tenant or public-facing network segments regardless of patch status.
If you depend on a carrier’s infrastructure: This is a supply-side issue. The direct action is ensuring your carrier relationships and security audits include core network security requirements.
Source: Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw — The Hacker News, July 31, 2026.
Found this useful? Share it.
