84 Flaws Found in 4G and 5G Core Networks, Including Live Session Hijacking
An NTU study disclosed a widespread class of 84 vulnerabilities in the signaling core of 4G and 5G networks — not the radio — including one that lets an attacker hijack a user's live session. The shared root cause is implicit trust between core network functions. Here is what operators should do.
An academic study has disclosed a "widespread class" of security flaws in the core of 4G and 5G mobile networks — the signaling brain that routes calls and data, not the radio towers users see — and among the 84 vulnerabilities is one serious enough to let an attacker hijack a subscriber's live session and reroute their traffic. The research, from a team at Singapore's Nanyang Technological University (NTU), reframes a problem the industry has treated as a scattering of isolated bugs into something closer to a structural weakness in how carrier networks trust their own components.
The findings, published in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis" and reported by The Hacker News, describe two concrete impact classes: denial-of-service (DoS), which can knock core network functions offline, and session hijacking, which lets an attacker seize control of a user's active network session. Of the 84 flaws, the researchers say 83 have been confirmed by developers and 81 have been assigned CVE identifiers. Every one of them sits inside the core — the control plane — rather than in the air interface.
What the Researchers Found
The NTU team examined seven widely used open-source cellular cores — two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF) — across two core signaling protocols, GTP-C and PFCP. These are the same open-source stacks that underpin academic testbeds and, in the researchers' words, "commercial deployments alike."
To surface the flaws at scale, the team built an LLM-assisted multi-agent system called iFinder that catalogs known weaknesses, sorts them into detection patterns, hunts for new instances, and then generates and tests proof-of-concept exploits to weed out false positives. Running it against the seven cores turned up 84 previously unknown vulnerabilities. Notably, some flaws in the 5G systems were inherited directly from their 4G predecessors — a sign that security debt is jumping generations as operators layer new cores on old assumptions.
● WHERE THE 84 FLAWS SIT Every one of the 84 vulnerabilities is in the mobile core — the signaling/control plane — not the radio access network. |
SESSION HIJACKING Seize control of a subscriber’s live network session and reroute their traffic to an attacker. |
DENIAL-OF-SERVICE (DoS) Crash or knock core network functions offline, disrupting service for everyone they carry. |
Stack location: GTP-C and PFCP signaling protocols · 7 open-source 4G/5G cores tested · 83 confirmed, 81 CVEs assigned. Source: NTU paper (arXiv 2607.10315), as reported by The Hacker News. |
Why the Core Trust Model Broke
The researchers trace all 84 flaws to a single recurring root cause they call implicit trust errors, or "iTrue": core network functions blindly acting on messages from internal peers without validating message format, semantics, or resource availability. For decades that blind trust was defensible, because core interfaces lived inside a physically isolated trust zone. A network function could assume that any message reaching it had already passed a hardware boundary.
The move to cloud-native, virtualized cores dissolved that assumption. As functions migrate to shared infrastructure and software-defined interfaces, the physical boundary that justified implicit trust becomes, in the researchers' word, "fragile" — and interfaces that were once unreachable can become exposed. The attacks the paper describes generally assume an adversary who can obtain the IP address of core components and reach those internal interfaces, whether as a remote actor exploiting a cloud misconfiguration or as a malicious device connected to the network. That precondition matters: this is not a break-any-network-from-anywhere result. But it is a direct warning about what happens when signaling-plane interfaces drift toward the open internet — the same exposure pattern behind recent allied warnings about state actors probing critical-infrastructure routers.
My read: the significance here is less any single CVE than the pattern. When 81 CVEs share one root cause across seven independent codebases, that points at an industry-wide design assumption, not a run of coincidental coding mistakes. Confidence in that framing is high — it is the paper's central, developer-confirmed claim.
What It Means for Defenders
The paper is largely a study of open-source reference cores, but the researchers say the session-hijacking weakness was also confirmed on two real-world commercial 5G cores. One vendor, Dotouch, has patched its XproUPF product (tracked as CVE-2026-8233, CVSS 4.6); the second, described only as a major 5G carrier, is still remediating. For telecom operators and enterprises running private 5G, that combination — a systemic root cause plus at least one confirmed commercial hit — is the actionable signal. It also arrives as regulators tighten telecom-infrastructure rules, as with the FCC's new cybersecurity requirements for emergency systems and undersea cables.
Concrete steps for core operators:
- Inventory your core network functions. Enumerate every SMF, UPF, SGW-C, and related function; which implementation backs it (open-source or vendor); and which signaling protocols — GTP-C, PFCP — it speaks.
- Apply vendor patches as they land. With 81 CVEs assigned, fixes will roll out unevenly across open-source projects and commercial vendors. Track advisories against your inventory rather than waiting for a single omnibus patch.
- Restrict signaling-plane exposure. Treat GTP-C and PFCP interfaces as sensitive internal surfaces. Verify that cloud and virtualization configurations do not expose them to untrusted networks, and segment the control plane away from anything an attacker or a rogue device could reach — the kind of rogue mobile hardware behind incidents like the SMS blasters that prowled Canadian streets.
- Watch for coordinated advisories. Monitor GSMA and 3GPP channels, along with your vendors' security bulletins, for coordinated disclosure tied to this research.
Open Questions
Several things remain unconfirmed. The paper centers on open-source cores and two commercial 5G deployments; it does not publish a broad list of affected commercial vendors, so whether the major equipment makers that dominate carrier networks share the same flaws is not established here — treat any such claim as unverified until a vendor or the researchers say so. The identity of the "major 5G carrier" still remediating is undisclosed. And as of this writing, there is no publicly visible coordinated GSMA or 3GPP advisory responding to the work; one may follow, but it should not be assumed.
