CVE-2026-44475

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la 1.10.0, Ella Core no verifica las capacidades de seguridad del UE recibidas en los mensajes NGAP PathSwitchRequest frente a sus valores almacenados localmente. Un gNB malicioso puede sobrescribir las capacidades de seguridad del UE almacenadas en Ella Core para cualquier UE con valores arbitrarios enviando un único PathSwitchRequest manipulado. Esta vulnerabilidad está corregida en la 1.10.0.

Information

Published : 2026-05-27 17:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44475

Mitre link : CVE-2026-44475

CVE.ORG link : CVE-2026-44475

JSON object : View

Products Affected

No product.

CWE

CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2026-44475", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44475", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:35:53.555635Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.10.0"}]}]}], "published": "2026-05-27T17:16:39.360", "references": [{"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la 1.10.0, Ella Core no verifica las capacidades de seguridad del UE recibidas en los mensajes NGAP PathSwitchRequest frente a sus valores almacenados localmente. Un gNB malicioso puede sobrescribir las capacidades de seguridad del UE almacenadas en Ella Core para cualquier UE con valores arbitrarios enviando un \u00fanico PathSwitchRequest manipulado. Esta vulnerabilidad est\u00e1 corregida en la 1.10.0."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}