CVE-2026-44474

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.10.0, Ella Core no aplicaba reglas de seguridad sobre la ejecución concurrente de procedimientos de seguridad definidos en TS 33.501 §6.9.5.1 - podía enviar un comando de modo de seguridad NAS mientras una transferencia N2 aún estaba pendiente (y viceversa). El comando de modo de seguridad concurrente y la transferencia N2 producen un desajuste de KgNB entre el UE y el gNB objetivo, lo que provoca que la transferencia falle. Requiere un gNB estancado más una condición de carrera de re-registro para activarse. Esta vulnerabilidad está corregida en la versión 1.10.0.

Information

Published : 2026-05-27 17:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44474

Mitre link : CVE-2026-44474

CVE.ORG link : CVE-2026-44474

JSON object : View

Products Affected

No product.

CWE

CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2026-44474", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44474", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:22:21.103731Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.10.0"}]}]}], "published": "2026-05-27T17:16:39.220", "references": [{"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 \u00a76.9.5.1 \u2014 it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.10.0, Ella Core no aplicaba reglas de seguridad sobre la ejecuci\u00f3n concurrente de procedimientos de seguridad definidos en TS 33.501 \u00a76.9.5.1 - pod\u00eda enviar un comando de modo de seguridad NAS mientras una transferencia N2 a\u00fan estaba pendiente (y viceversa). El comando de modo de seguridad concurrente y la transferencia N2 producen un desajuste de KgNB entre el UE y el gNB objetivo, lo que provoca que la transferencia falle. Requiere un gNB estancado m\u00e1s una condici\u00f3n de carrera de re-registro para activarse. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.10.0."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}