84 previously unknown vulnerabilities were uncovered across widely used 4G and 5G core implementations, and researchers warn the defects share a single recurring root cause: implicit trust between core network functions.
Nanyang Technological University study
A team from Singapore's Nanyang Technological University published the findings in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis." The study reports a "widespread class" of security vulnerabilities it calls implicit trust errors, or iTrue, affecting the signaling interfaces of LTE and 5G core networks.
The researchers examined two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF) across two core signaling protocols, GTP-C and PFCP. Running their system against those seven open-source core network (CN) implementations uncovered 84 previously unknown vulnerabilities; 83 of those have been confirmed and 81 have been assigned CVE identifiers.
iFinder: an LLM-assisted multi-agent discovery system
To detect and analyze iTrue flaws the team developed iFinder, an LLM-assisted multi-agent system. According to the paper, iFinder performs several tasks: it summarizes known flaws, categorizes them into detection patterns, and uses those patterns as a basis to discover new implicit trust errors in core network implementations.
The researchers describe a multi-stage process: they first generate candidate flaws, then use a "novel code-specification cross-checking technique" to eliminate hallucinations and false positives. Next, an LLM-driven approach helps generate proof-of-concept (PoC) exploits that are refined iteratively by executing them against CN implementations and analyzing the results. Eliminating false positives involves mapping a candidate iTrue to the protocol procedure it implements and checking whether necessary validation and resource checks are actually enforced in the codebase.
How GTP-C and PFCP can be abused: DoS and session hijacking mechanics
The study highlights specific classes of implementation weaknesses: insufficient validation of message format and semantics, and lack of checks for resource availability. These issues allow CN components to "blindly act on messages received from internal peers," the researchers said, creating attack opportunities if those internal interfaces become reachable.
Successful exploitation, the paper stresses, assumes an adversary can obtain IP addresses of core network components (via public documentation, passive enumeration, or active scanning) and has access to internal core network interfaces to send arbitrary PFCP and GTP-C messages in violation of the trust model by exploiting cloud deployment misconfigurations. The attacker can be remote or a malicious User Equipment (UE) connected to a mobile network; in the latter case the attacker injects crafted payloads into the uplink data stream.
The researchers describe a DoS example against Open5GS LTE in which specially crafted GTPv2-C Create Session Request messages cause the Serving Gateway Control plane (SGW-C) to crash. For session hijacking, they outline a concrete PFCP-based chain:
- An attacker issues a PFCP Association Setup Request to the User Plane Function (UPF).
- The victim UE attaches, triggering the SMF to send a PFCP Session Establishment Request to the UPF.
- The attacker sends a PFCP Session Modification Request that reuses the victim's Packet Detection Rule (PDR) ID with a lower Precedence (higher priority) and binds it to a malicious Forwarding Action Rule (FAR).
- The UPF accepts the duplicate PDR, sorts PDRs by precedence, and places the malicious rule ahead of the legitimate one; packet processing then matches the malicious PDR first and forwards the victim's uplink traffic to the attacker.
At a protocol boundary level the paper explains: "By exploiting protocol tunnelling and network boundary bridging, the attacker smuggles crafted PFCP or GTP-C messages inside GTP-U messages so that, absent strict boundary enforcement, they cross the boundary and are delivered to and parsed by core-network components."
Confirmed real-world impact: Dotouch XproUPF and an unnamed major 5GC vendor
The researchers report that the session hijacking vulnerability was discovered on two real-world commercial 5G core networks. One vendor, Dotouch, addressed the defect in XproUPF (CVE-2026-8233, CVSS score: 4.6). A second commercial 5GC vendor — described in the paper as an unnamed major 5G carrier — remains in the remediation process.
The paper also notes that some iTrue flaws in 5G systems were inherited from 4G counterparts, illustrating how risks can persist across generations when legacy behaviors are ported into modern, cloud-native deployments.
What this means for technologists, network operators, and vendors
- Technologists and security teams: Expect to prioritize validation and boundary enforcement for PFCP and GTP-C message handling, and to audit cloud deployment configurations that expose internal CN interfaces. The paper's methods — automated pattern discovery and code-spec cross-checking — informed the vulnerabilities found.
- Network operators and vendors: Vendors with affected products will need to track assigned CVEs (81 assigned to date) and push patches; operators should limit exposure of internal interfaces and monitor for enumeration or anomalous PFCP/GTP-C traffic. The study warns that the transition to cloud-native deployments has made the traditional trust model "fragile" and expanded the attack surface.
- Public and enterprise customers: The concrete session-hijacking scenario shows user traffic could be redirected if core functions accept unauthenticated or insufficiently validated control messages — a technical pathway the paper demonstrates across open-source and commercial implementations.
Summing up, the researchers framed the problem as systemic: "Our research finds these vulnerabilities share a single recurring root cause, implicit trust between core network functions, and are present in widely used open-source LTE/5G cores that back research testbeds and commercial deployments alike," they said. Ziyu Lin, one of the paper's authors, added: "The continually increasing number of vulnerabilities demonstrates that this is not a small collection of isolated implementation bugs, but a broader and ongoing security problem that requires urgent attention from vendors and network operators."
