Ella Core, a 5G core platform designed for private networks, has a flaw in older releases that causes the service to panic when processing NGAP messages containing PDU Session IDs outside the valid range of 1‑15. The panic conditions result in a process crash and the abrupt termination of the core, which disrupts services for all subscribers in the network. This weakness is an integer range error (CWE‑129) and does not depend on any privileged access to the system.

All installations of Ellanetworks Ella Core running any version older than 1.6.0 are affected. The problem is specific to the handling of NGAP protocol messages within the core stack; newer releases add validation to prevent the crash.

The CVSS base score of 6.5 indicates a moderate severity for this denial‑of‑service vulnerability. EPSS suggests that exploitation is uncommon, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to transmit crafted NGAP packets to the core; no authentication is necessary. The likely attack vector is remote control of the NGAP interface, where an adversary can inject malformed traffic without additional prerequisites. Because the vulnerability is triggered by any out‑of‑range PDU Session ID, an attacker could trigger the crash simply by sending such packets over the network.