Tag
Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse (CVE-2026-44473)
2 rules 1 TTPElla Core is vulnerable to UE downlink redirection (CVE-2026-44473) due to missing SCTP association verification, enabling a malicious radio to forge a PDUSessionResourceSetupResponse and redirect downlink traffic.
free5GC SMF Unauthenticated UPI Access
2 rules 1 TTP 2 IOCsfree5GC's Session Management Function (SMF) UPI interface lacks authentication, allowing unauthenticated network attackers to read/write/delete UP-node and link topology data via exposed APIs.
free5GC UDR Memory Leak Vulnerability Leads to Denial of Service
2 rules 1 TTP 1 CVEAn unauthenticated attacker can exploit a memory leak in free5GC UDR versions prior to 1.4.3 by sending repeated HTTP requests to the OAM endpoint, causing uncontrolled memory growth and denial of service.
Free5GC PCF Authentication Bypass Vulnerability
2 rules 1 TTPFree5GC PCF versions prior to 1.4.3 are vulnerable to an authentication bypass due to missing middleware, allowing unauthenticated access to SM policy handlers and disclosure of subscriber SUPI.
free5GC NEF Unauthenticated Callback Vulnerability
2 rules 1 TTPfree5GC NEF v4.2.1 exposes an unauthenticated callback route group, enabling attackers to forge SMF callbacks and potentially corrupt AF traffic-influence or PFD-management subscription views, leading to unauthorized policy changes.
Ella Core NGAP Message Handling Vulnerability Leads to Denial of Service
3 rules 1 TTPElla Core versions prior to 1.6.0 are vulnerable to a denial-of-service attack where a crafted NGAP LocationReport message with a missing `UEPresenceInAreaOfInterestList` can crash the process, disrupting service for all connected subscribers.