An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks. If successfully exploited, these flaws could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session. The findings were released by researchers from **Singapore's Nanyang Technological University** in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis." ### The Nature of Implicit Trust Errors (iTrue) The study uncovered dozens of vulnerabilities in the signaling interfaces of LTE/5G core networks. Specifically, it examined two LTE implementations (**Open5GS** and **OpenAirInterface**) and five 5G implementations (**Open5GS**, **free5GC**, **OpenAirInterface**, **SD-Core**, and **eUPF**). These vulnerabilities span two core signaling protocols: **GPRS Tunnelling Protocol Control Plane (GTP-C)** and **Packet Forwarding Control Protocol (PFCP)**. Researchers identified a common root cause: implicit trust between core network functions. This blind trust, coupled with weaknesses in these interfaces, can be exploited by external actors for malicious activities, including DoS and session hijacking, when these interfaces become internet-reachable. These errors have been codenamed implicit trust errors (**iTrue**). ### The Shift to Cloud-Native and Expanded Attack Surface Historically, cellular core networks (CNs) relied on physical isolation to ensure interfaces between core network functions operated within a trusted zone. However, the transition to cloud-native deployments has made this trust model "fragile," significantly expanding the attack surface and potentially exposing previously internal interfaces. ### iFinder: An LLM-Assisted Discovery System To detect iTrues and understand their consequences, the study developed a large language model (LLM)-assisted multi-agent system called **iFinder**. This system performs several tasks: summarizing known flaws, categorizing them into detection patterns, and using this foundation to discover new iTrues in CN implementations. Some identified weaknesses relate to a lack of due diligence in validating message format, message semantics, and resource availability, with CN components blindly acting on messages received from internal peers.  In a subsequent phase, iFinder weeds out hallucinations and false positives using a "novel code-specification cross-checking technique." An LLM-driven approach then generates proof-of-concept (PoC) exploits for potential iTrues, iteratively refining them by executing them against CN implementations and analyzing the results. ### Uncovering Dozens of New Vulnerabilities Running iFinder against the seven aforementioned 4G and 5G open-source CN implementations uncovered 84 previously unknown vulnerabilities. Of these, 83 have been confirmed, and 81 have been assigned **CVE** identifiers. Notably, some iTrue flaws in 5G systems were inherited from their 4G counterparts. This highlights how security risks can persist across generations and how a failure to adapt legacy security practices to modern deployments can introduce new, unaddressed concerns. ### Attack Scenarios and Impact Successful attacks based on DoS and session hijacking iTrue flaws require an adversary to obtain the IP address of core network components (e.g., from public documentation, passive enumeration, or active scanning). The attacker also needs access to internal core network interfaces and the ability to send arbitrary **PFCP** and **GTP-C** messages, violating the trust model by exploiting misconfigurations in cloud deployments. This attacker could be remote or a malicious User Equipment (**UE**) injecting carefully crafted payloads into the uplink data stream. Researchers explained: "By exploiting protocol tunnelling and network boundary bridging, the attacker smuggles crafted **PFCP** or **GTP-C** messages inside **GTP-U** messages so that, absent strict boundary enforcement, they cross the boundary and are delivered to and parsed by core-network components." #### Hypothetical DoS Attack In a hypothetical DoS attack scenario against **Open5GS LTE**, an attacker could send **GTPv2-C** messages to trigger a vulnerability when parsing **GTPv2-C Create Session Request** messages, causing the **Serving Gateway Control plane (SGW-C)** to crash. #### Session Hijacking Example For session hijacking, an internet adversary could perform the following sequence of actions: 1. The attacker sends a **PFCP Association Setup Request** to the **User Plane Function (UPF)**. 2. The victim **UE** initiates an "attach," prompting the **SMF** to send a **PFCP Session Establishment Request** to the **UPF**. 3. The attacker then issues a **PFCP Session Modification Request** that reuses the victim's **Packet Detection Rule (PDR) ID** with a lower Precedence value (higher priority) and binds it to a malicious **Forwarding Action Rule (FAR)**. 4. The **UPF** admits the duplicate **PDR** and sorts **PDRs** by precedence, placing the malicious rule ahead of the legitimate one. 5. During packet processing, the **UPF** matches the malicious **PDR** first, establishing a new forwarding tunnel between the **UPF** and the attacker. 6. The victim's uplink traffic is forwarded to the attacker instead of the internet.  "At a high level, this flaw allows an attacker to inject a **PFCP Session Modification Request**, causing the **User Plane Function (UPF)** to forward the victim **UE's** uplink traffic to the attacker," the researchers noted.  ### Real-World Impact and Remediation The session hijacking vulnerability was discovered on two real-world commercial 5G core networks. One vendor, **Dotouch**, has since addressed the defect in **XproUPF** (**CVE-2026-8233**, CVSS score: 4.6). The second commercial 5GC vendor, an unnamed major 5G carrier, is still in the remediation process. "The continually increasing number of vulnerabilities demonstrates that this is not a small collection of isolated implementation bugs, but a broader and ongoing security problem that requires urgent attention from vendors and network operators," said **Ziyu Lin**, one of the study's authors.