Mobile networks are often treated as highly protected infrastructure, hidden behind layers of carrier-grade security that ordinary attackers cannot easily reach. However, a new academic study suggests that some of the most important systems inside 4G and 5G networks may be relying on an outdated assumption: that anything communicating from inside the network can automatically be trusted.
Researchers from Singapore's Nanyang Technological University discovered 84 previously unknown vulnerabilities across several open-source 4G and 5G core-network implementations. Some of the weaknesses could crash essential network components, while a more serious flaw could potentially redirect a subscriber's mobile traffic away from its legitimate destination. The research has been accepted for presentation at USENIX Security 2026.
The Mobile Core Is the Brain Behind the Network
When people think about mobile-network infrastructure, they may picture towers and antennas. Those radio systems are important, but much of the real work happens deeper inside the carrier's core network.
The core is responsible for authenticating devices, establishing data sessions, managing mobility and deciding how traffic moves between a phone and the internet. In simple terms, it acts as the control centre that keeps mobile connectivity functioning.
In 4G networks, components such as the Mobility Management Entity, Serving Gateway and Packet Data Network Gateway handle these responsibilities. In 5G, many of those roles are separated into more specialised network functions, including the Session Management Function and User Plane Function.
That more modular design can improve flexibility and scalability, but it also creates more internal communication paths that must be protected correctly.
An Old Trust Model Meets Cloud-Native Infrastructure
Historically, telecom operators protected their core systems through physical and network isolation. Internal interfaces were placed inside carefully controlled environments that outsiders were not expected to reach.
Because of that architecture, software developers could assume that messages arriving from another internal network component were legitimate. Some implementations therefore performed fewer checks than they would on traffic coming directly from the public internet.
That assumption becomes much more dangerous as carriers move network functions into cloud platforms, virtual machines and containerised environments. Cloud-native deployments introduce complicated routing, shared infrastructure and the possibility of configuration mistakes that accidentally expose internal services.
The researchers argue that the network perimeter has changed, but parts of the software still behave as though the old physical isolation remains fully intact.
The Researchers Call Them "Implicit Trust Errors"
The study groups the newly discovered weaknesses into a broader category called implicit trust errors, shortened to iTrue.
These flaws appear when one core-network component assumes another component will always send properly formatted, logically valid and reasonable requests. Instead of verifying each message carefully, the receiving system may immediately process it.
The researchers identified three recurring problems:
A malformed message could therefore trigger a crash, while a technically valid message sent in the wrong context could manipulate how a session is handled.
The key issue is not one isolated programming mistake. Similar trust assumptions appeared across multiple implementations, programming languages and mobile-network generations.
Seven Open-Source Mobile Cores Were Examined
The researchers tested seven widely used open-source core-network implementations covering both LTE and 5G:
These projects are commonly used in academic research, development environments, private mobile networks and commercial testing. Some may also form part of real-world products or serve as reference implementations for other systems.
The analysis covered two important signalling protocols: GTP-C, which is widely associated with LTE core-network control functions, and PFCP, which is used to manage packet-forwarding behaviour in modern mobile networks.
Across the seven implementations, the tool reported 84 previously unknown vulnerabilities. According to the latest version of the paper, developers had confirmed 83 of them and 81 had received CVE identifiers at the time of publication.
Most of the Problems Were Concentrated in Key Components
The study found that the weaknesses were not distributed evenly across every network function.
In the tested 4G systems, many of the GTP-C problems appeared in the Serving Gateway. In the 5G implementations, a large proportion of the PFCP weaknesses affected the User Plane Function.
That concentration is concerning because these systems sit directly in the path of mobile data. If they fail, mishandle a forwarding rule or crash unexpectedly, subscribers may lose connectivity or have their traffic handled incorrectly.
The findings also suggest that some security assumptions travelled from 4G into 5G. Instead of disappearing with the newer standard, legacy weaknesses may have been carried forward into updated implementations.
This matters because many operational mobile networks support 4G and 5G simultaneously. A vulnerability in an older component does not necessarily become irrelevant simply because a carrier has launched 5G service.
Denial-of-Service Attacks Could Disrupt Mobile Connectivity
A significant number of the discovered weaknesses could be used to cause denial-of-service conditions.
In one example examined by the researchers, a vulnerable 4G core implementation could be made to consume internal resources while processing repeated session requests. Instead of rejecting further requests cleanly when its available resources were exhausted, the affected component could terminate.
For a subscriber, the result could appear as failed mobile-data connections or temporary service disruption. At a larger scale, repeated attacks against an exposed core function could affect many users.
The paper's broader point is that internal network software should not assume other components will behave politely. Every request should be treated as potentially malformed, excessive or unexpected—even when it appears to originate from inside the carrier network.
The Session-Hijacking Finding Is More Serious
The most concerning discovery involved the rules used by a 5G User Plane Function to decide where subscriber traffic should be forwarded.
The affected systems did not properly prevent conflicting forwarding-rule identifiers from being introduced into an existing session. Under the researchers' test conditions, a malicious rule could be given priority over the legitimate rule.
Instead of sending the subscriber's uplink traffic towards the internet, the vulnerable User Plane Function could redirect it towards infrastructure controlled by the attacker.
The researchers reproduced this behaviour in an OpenAirInterface 5G test environment and later confirmed the underlying flaw in two commercial 5G core-network products during vendor-approved testing. One vendor fixed the issue, while the second was still working on remediation when the paper was prepared.
One Commercial Vulnerability Is Tracked as CVE-2026-8233
One of the affected commercial systems was Dotouch XproUPF, with the session-related weakness tracked as CVE-2026-8233.
The National Vulnerability Database describes the issue as an improper access-control weakness affecting the User Plane Function. Its published CVSS 3.1 score is 4.6, placing it in the medium-severity category, while also noting that exploitation is complex and requires a privileged network position.
That score should not be interpreted as meaning the underlying behaviour is unimportant. CVSS considers factors such as accessibility, required privileges and attack complexity—not only the worst technical consequence.
A flaw capable of changing where subscriber traffic is forwarded remains significant, particularly in environments where internal network boundaries have been weakened through poor cloud configuration.
These Are Not Simple Attacks Against Any Phone
The findings do not mean that someone can download an application and instantly hijack any nearby 4G or 5G connection.
The researchers' threat model assumes that an attacker has found a path to internal core-network interfaces that should normally remain protected. That might happen through cloud misconfiguration, insufficient segmentation or another weakness that bridges the boundary between public and internal systems.
The attacker would also need enough information and network access to send specialised signalling messages to the relevant core function.
In other words, these vulnerabilities become especially dangerous when paired with deployment mistakes. A properly isolated and authenticated internal interface would substantially reduce the opportunity to exploit them.
Still, security architecture should not depend entirely on a perfect perimeter. If one mistake exposes a service, the software behind it should continue validating every message rather than immediately trusting it.
An AI-Assisted System Helped Find the Flaws
The research team developed an LLM-assisted multi-agent system called iFinder to search for the vulnerabilities.
The system first examined previously reported security issues and converted their underlying causes into reusable detection patterns. Separate agents then searched other codebases for similar behaviour.
Because large language models can misunderstand code or invent problems that do not actually exist, the researchers added a vetting stage. Potential findings were cross-checked against both the implementation and relevant protocol specifications.
A separate validation stage generated controlled proof-of-concept tests and refined them inside laboratory environments. This allowed the researchers to distinguish exploitable weaknesses from theoretical findings or false positives.
AI Did Not Replace Human Security Verification
The use of an LLM is likely to attract attention, but the important part of the project is not simply that artificial intelligence searched the source code.
The researchers built a structured process around the model. Candidate issues were compared with protocol requirements, examined in their wider code context and tested inside controlled environments.
This matters because a local code fragment may appear unsafe even when another function performs the necessary validation earlier. Without sufficient context, an AI system could incorrectly report such code as vulnerable.
The study therefore demonstrates a more realistic role for AI in cybersecurity: accelerating discovery while still requiring specifications, runtime testing, responsible disclosure and expert review.
The paper also acknowledges that iFinder cannot guarantee complete coverage. It may miss vulnerabilities that do not resemble its existing detection patterns, and difficult implementation details can still lead to incorrect judgements.
Why Open-Source Findings Matter to Commercial Networks
It would be easy to dismiss the results because the main analysis focused on open-source implementations.
However, open-source telecom projects are important because they are used for research, testing, private networks, prototypes and commercial development. More importantly, the same design assumptions may exist in proprietary products.
That concern was confirmed when the researchers reproduced the session-hijacking weakness in two commercial 5G core networks. The flaw was not limited to one open-source project or programming language; it reflected a broader failure to enforce uniqueness and trust boundaries correctly.
The study does not claim that every commercial 4G or 5G network is affected. It does show that reviewing open-source implementations can reveal architectural patterns that deserve attention throughout the wider telecom industry.
Telecom Security Needs a Zero-Trust Approach
The researchers recommend changes at the specification, software and deployment levels.
Mobile-network standards should account for modern cloud environments where internal interfaces may no longer be completely unreachable. Strong mutual authentication should be considered between network functions instead of assuming that location inside the core proves legitimacy.
Developers should validate both message formatting and meaning. They should also reject duplicate identifiers, enforce resource limits and handle unexpected requests without crashing.
Operators, meanwhile, need strict network segmentation, least-privilege access and continuous reviews of cloud configurations. Internal signalling interfaces should never be publicly reachable simply because of an overlooked firewall rule or routing mistake.
The Findings Matter Beyond Mobile Networks
The same lesson applies to many other forms of critical infrastructure.
Hospitals, financial systems, cloud environments and corporate networks often contain older applications that assume anything on the internal network can be trusted. That approach becomes fragile as organisations adopt cloud services, remote access and interconnected platforms.
Once an attacker crosses the outer boundary, an overly trusting internal system can make lateral movement much easier.
The answer is not to abandon perimeter security, but to combine it with strong internal verification. Every component should authenticate its peers, validate requests and limit what another system is allowed to do.
Final Thoughts
The discovery of 84 vulnerabilities across seven 4G and 5G core-network implementations highlights a problem that is larger than one defective program.
Mobile-core software has historically operated within highly isolated environments. As those environments move into cloud-native infrastructure, old assumptions about trusted internal communication no longer provide enough protection.
The most serious finding demonstrates what can happen when that trust is abused: a forwarding rule can be accepted without sufficient validation, potentially redirecting a subscriber's traffic. Other vulnerabilities can exhaust resources and crash essential network functions.
It is reassuring that most of the findings have already been confirmed and assigned CVE identifiers, and that coordinated remediation is underway. However, the study also shows that launching a newer network generation does not automatically remove the security weaknesses inherited from older designs.
The future of 5G security will depend not only on faster radios and stronger encryption at the network edge, but also on whether every component inside the core stops assuming that internal automatically means trustworthy.
Comments 0