Ellanetworks Core is a 5G core for private networks. A flaw in the NGAP LocationReport parsing causes a panic when an attacker sends a malformed message that includes the event type "ue-presence-in-area-of-interest" but omits the optional "UEPresenceInAreaOfInterestList" information element. The panic terminates the core process, leading to a complete drop of all functionalities for connected subscribers. The weakness is a null pointer dereference (CWE-476) that triggers a denial of service.

The issue is limited to Ellanetworks Core versions before 1.6.0. Any deployment of the core software that has not been upgraded to 1.6.0 or later is vulnerable. The affected component is the NGAP message handler in the core network stack.

With a CVSS score of 7.5 the vulnerability is considered high severity, yet the EPSS score of less than 1% indicates a low likelihood of immediate exploitation. The vulnerability is not cataloged in CISA’s KEV list, and no authentication is required to trigger the crash, so remote attackers could abuse it over the air interface. The patch introduced explicit IE presence verification, eliminating the crash path.