CVE-2026-44473

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.10.0, una radio con una configuración NG válida puede enviar una respuesta PDUSessionResourceSetupResponse falsificada que transporta el AMF-UE-NGAP-ID de cualquier UE. Ella Core no verifica que el mensaje llegó a la asociación SCTP vinculada a la conexión NG lógica de ese UE, luego crea un túnel GTP hacia esa radio. Esta vulnerabilidad está corregida en la versión 1.10.0.

Information

Published : 2026-05-27 17:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44473

Mitre link : CVE-2026-44473

CVE.ORG link : CVE-2026-44473

JSON object : View

Products Affected

No product.

CWE

CWE-358

Improperly Implemented Security Check for Standard

CWE-863

Incorrect Authorization

{"id": "CVE-2026-44473", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44473", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T14:33:19.699329Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.10.0"}]}]}], "published": "2026-05-27T17:16:39.070", "references": [{"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-358"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.10.0, una radio con una configuraci\u00f3n NG v\u00e1lida puede enviar una respuesta PDUSessionResourceSetupResponse falsificada que transporta el AMF-UE-NGAP-ID de cualquier UE. Ella Core no verifica que el mensaje lleg\u00f3 a la asociaci\u00f3n SCTP vinculada a la conexi\u00f3n NG l\u00f3gica de ese UE, luego crea un t\u00fanel GTP hacia esa radio. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.10.0."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}