Full Report
An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session. The findings have been released by a group of researchers from Singapore's Nanyang Technological University
Analysis Summary
# Vulnerability: Widespread "Implicit Trust Errors" (iTrue) in 4G/5G Core Networks
## CVE Details
- **CVE ID**: 81 individual CVEs assigned (Specific IDs not listed in the summary, but associated with the "iTrue" class of flaws).
- **CVSS Score**: Not specifically listed (High/Critical potential based on impact).
- **CWE**:
- CWE-287: Improper Authentication (Implicit Trust)
- CWE-20: Improper Input Validation
- CWE-400: Uncontrolled Resource Consumption
## Affected Systems
- **Products**: Open-source LTE and 5G Core Network implementations.
- **Versions**: Specific versions of:
- **LTE**: Open5GS, OpenAirInterface (OAI).
- **5G**: Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF.
- **Configurations**: Cloud-native deployments where internal signaling interfaces (GTP-C and PFCP) are exposed or reachable due to network misconfigurations.
## Vulnerability Description
Researchers identified a "widespread class" of security flaws termed **Implicit Trust Errors (iTrue)**. These vulnerabilities stem from a lack of validation between Core Network (CN) functions. Because these components historically operated in physically isolated environments, they "blindly trust" incoming signaling messages.
Technical flaws include:
- **Missing Validation**: Failure to verify message format, semantics, and uniqueness (e.g., duplicate PDR IDs in PFCP requests).
- **Protocol Weaknesses**: Flaws in the GPRS Tunnelling Protocol Control Plane (**GTP-C**) and Packet Forwarding Control Protocol (**PFCP**).
- **Inherited Risk**: 5G implementations have inherited legacy vulnerabilities from 4G signaling logic.
## Exploitation
- **Status**: 83 flaws confirmed; PoC exploits generated by the "iFinder" LLM-based tool.
- **Complexity**: Medium to High (Requires knowledge of internal IP addresses and signaling protocols).
- **Attack Vector**: Network (Remote via internet-exposed interfaces or via a malicious User Equipment/UE).
## Impact
- **Confidentiality**: High (Session hijacking allows attackers to seize control of user network sessions).
- **Integrity**: Medium (Potential for unauthorized modification of session parameters).
- **Availability**: High (Triggering Denial-of-Service [DoS] against core network functions).
## Remediation
### Patches
- Developers of the impacted open-source projects (Open5GS, free5GC, etc.) have been notified. Users should update to the latest versions of these platforms as of July 2026.
### Workarounds
- **Network Segmentation**: Implement strict firewall rules to ensure GTP-C and PFCP interfaces are not reachable from the public internet or unauthorized network segments.
- **Mutual Authentication**: Transition away from implicit trust models by implementing IPsec or TLS between core network functions.
## Detection
- **Indicators of Compromise**:
- Unusual volumes of PFCP Session Modification Requests.
- Duplicate PDR (Packet Detection Rule) IDs in signaling logs.
- Rapid succession of GTP-C messages from unrecognized source IPs.
- **Detection methods**:
- Use of protocol-aware Intrusion Detection Systems (IDS) to monitor signaling traffic for malformed or out-of-sequence packets.
## References
- **Academic Paper**: hxxps[://]arxiv[.]org/abs/2607.10315
- **Research Website**: hxxps[://]linziyuu[.]github[.]io/iFinder-Website/
- **News Source**: hxxps[://]thehackernews[.]com/2026/07/researchers-report-84-flaws-in-4g-and.html