Recent research has identified a significant number of security vulnerabilities within the core infrastructures of 4G and 5G networks. These flaws, if exploited, could lead to denial-of-service (DoS) attacks and session hijacking, potentially allowing attackers to take control of user sessions.
The study, conducted by a team from Singapore’s Nanyang Technological University, focused on the signaling interfaces of LTE and 5G core networks. The researchers examined two LTE implementations—Open5GS and OpenAirInterface—and five 5G implementations, including Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF. Their analysis spanned two core signaling protocols: GTP-C and PFCP.
A recurring issue identified across these implementations is the implicit trust between core network functions. Traditionally, cellular core networks relied on physical isolation to secure internal interfaces. However, the shift to cloud-native deployments has weakened this trust model, expanding the attack surface and making previously internal interfaces accessible to potential adversaries.
The researchers developed a multi-agent system named iFinder to detect these implicit trust errors, termed iTrues. This system utilizes large language models to summarize known flaws, categorize them into detection patterns, and discover new iTrues in core network implementations. The process involves generating proof-of-concept exploits and refining them through iterative testing against core network implementations.
Through this methodology, the team uncovered 84 previously unknown vulnerabilities, with 83 confirmed and 81 assigned Common Vulnerabilities and Exposures (CVE) identifiers. Notably, some of these flaws in 5G systems were inherited from their 4G counterparts, highlighting the persistence of security risks across network generations.
Exploiting these vulnerabilities requires attackers to obtain the IP addresses of core network components, which can be achieved through public documentation, passive enumeration, or active scanning. Additionally, attackers need access to the network interfaces where these vulnerabilities reside.
These findings underscore the critical need for robust security measures in the design and deployment of cellular networks. As the industry continues to transition to cloud-native architectures, it is imperative to reassess trust models and implement comprehensive validation and resource checks to mitigate potential threats.
