**Critical Security Flaws Found in 4G and 5G Core Networks**
A recent academic study has revealed a “widespread class” of critical security vulnerabilities affecting 4G and 5G core networks. These flaws, if exploited, could lead to denial-of-service (DoS) attacks or session hijacking, where an attacker takes control of a user’s network session. The research was conducted by a team from Singapore’s Nanyang Technological University and detailed in a paper titled “Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis.”
### The Vulnerabilities
The study identified dozens of vulnerabilities in the signaling interfaces of LTE and 5G core networks. These flaws were found in widely used open-source implementations, including Open5GS and OpenAirInterface for LTE, and Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF for 5G. The vulnerabilities span two key core signaling protocols: GPRS Tunnelling Protocol Control Plane (GTP-C) and Packet Forwarding Control Protocol (PFCP).
**Root Cause: Implicit Trust Errors**
A recurring theme among the vulnerabilities is “implicit trust” between core network functions. Traditionally, cellular core networks relied on physical isolation to secure interfaces, assuming they operated within a trusted zone. However, the shift to cloud-native deployments has made this trust model fragile, expanding the attack surface and potentially exposing internal interfaces to external threats.
The researchers termed these issues “implicit trust errors” (iTrue). They found that many network components blindly act on messages from internal peers without adequate validation of message format, semantics, or resource availability.
### Discovery Through AI: The iFinder Framework
To uncover these vulnerabilities, the researchers developed an AI-powered framework called iFinder. This system uses a large language model (LLM) assisted by a multi-agent setup to:
1. Summarize known flaws.
2. Categorize detection patterns.
3. Discover new iTrue flaws.
The system was tested against seven 4G and 5G open-source core network implementations, uncovering 84 previously unknown vulnerabilities. Of these, 83 have been confirmed, and 81 have been assigned Common Vulnerabilities and Exposures (CVE) identifiers.
### Real-World Exploitation
The researchers demonstrated that attacks could be launched remotely by an adversary outside the network or by a malicious User Equipment (UE) connecting to the network. The attacks exploit the trust model by smuggling malicious PFCP or GTP-C messages inside GTP-U messages, bypassing boundary defenses.
Two specific scenarios were detailed:
* **Denial-of-Service (DoS):** An attacker can send malformed GTPv2-C messages to crash critical control-plane elements, such as the Serving Gateway Control plane (SGW-C).
* **Session Hijacking:** An attacker can intercept a user’s data by manipulating PFCP messages. For example, by sending a malicious PFCP Session Modification Request with a higher-priority Precedence, an attacker can redirect a victim’s uplink traffic through a malicious Forwarding Action Rule (FAR) on the User Plane Function (UPF).
The study noted that these vulnerabilities are not isolated. Some flaws in 5G systems were inherited from 4G counterparts, highlighting the challenge of securing evolving network architectures. One vendor, Dotouch, has since patched a related flaw (CVE-2026-8233), while another major carrier is still working on remediation.
### FAQ Section
**Q: What are Implicit Trust Errors (iTrue)?**
A: Implicit Trust Errors (iTrue) are a class of security vulnerabilities that arise from core network functions assuming messages from internal peers are legitimate without proper validation. This blind trust is exploitable when network boundaries are not strictly enforced, particularly in cloud-native environments.
**Q: Which networks are affected?**
A: Both 4G (LTE) and 5G core networks are affected. The study examined open-source implementations including Open5GS, OpenAirInterface, free5GC, SD-Core, and eUPF.
**Q: What is the iFinder framework?**
A: iFinder is a Large Language Model (LLM)-assisted multi-agent system designed to discover and analyze these types of vulnerabilities. It automates the process of identifying flaws, generating proof-of-concept exploits, and filtering out false positives.
**Q: How can these vulnerabilities be exploited?**
A: Attackers can exploit these flaws to launch Denial-of-Service (DoS) attacks, crashing network components, or perform session hijacking, stealing user data by intercepting and redirecting network traffic.
**Q: What is the severity of these findings?**
A: The researchers describe this as a “widespread class” of vulnerabilities, indicating a systemic issue rather than a few isolated bugs. They warn that the continuously increasing number of identified flaws demonstrates an urgent, broad security problem requiring immediate attention from vendors and network operators.
### Conclusion
The research exposes a fundamental weakness in the trust models of modern cellular networks. What was once a security advantage of physical isolation has become a liability in the age of cloud-native infrastructure. The discovery of over 80 new vulnerabilities using an AI-driven framework underscores that this is a systemic issue demanding a paradigm shift in security practices. As networks continue to evolve, vendors and operators must prioritize robust validation and strict boundary enforcement to protect users from these critical threats.
