EUVD-2026-32563
GHSA-qfxw-v8qx-vj3v
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
Summary
A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio.
Impact
Downlink user-plane traffic for the targeted UE is redirected to the attacker's radio.
Fix
UE context lookups are now scoped to the sending radio's SCTP association.
AnalysisAI
User equipment (UE) downlink traffic can be redirected to attacker-controlled radios in Ella Core (5G AMF software) versions prior to 1.10.0. A malicious radio with a valid NG Setup connection can forge PDUSessionResourceSetupResponse messages using arbitrary AMF-UE-NGAP-IDs, causing Ella Core to create GTP tunnels that misdirect victim UE downlink packets to the attacker's radio. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Ella Core deployments and identify systems running versions prior to 1.10.0; isolate affected AMF instances from production if version confirmation is unavailable. Within 7 days: Deploy vendor patch to Ella Core version 1.10.0 across all affected 5G AMF infrastructure, prioritizing systems serving critical enterprise or government mobile users. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today