EUVD-2026-32561
GHSA-mc29-hmx6-856q
CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
Summary
Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 - it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).
Impact
Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger.
Fix
Ella Core now enforces both rules from §6.9.5.1, blocking concurrent Security Mode Command and N2 handover procedures.
AnalysisAI
Ella Core fails to enforce 3GPP TS 33.501 §6.9.5.1 security rules, allowing concurrent NAS Security Mode Command and N2 handover procedures that produce KgNB key mismatches between UE and target gNB, causing handover failures. Exploitation requires a stalled gNB combined with a re-registration race condition. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today