Ella Core allows the NetworkManager role to restore a database via an endpoint that accepts any valid SQLite file without validating its contents. This flaw permits an authorized NetworkManager to replace the production database with a tampered copy, elevating its permissions to full Administrator. As a result, the attacker gains unrestricted access to user management, audit logs, debug endpoints, and operator identity configuration—capabilities that the role was specifically denied. The weakness is an administrative interface that allows privilege escalation due to inadequate access control, classified as CWE-269.

The vulnerability exists in the Ella Core 5G core platform developed by ellanetworks. Versions before 1.7.0 grant the NetworkManager role backup and restore permissions, making these releases susceptible. The affected component is the database restore API that reads SQLite files in the core system.

The CVSS score of 7.2 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known publicly exploited instances yet. The likely attack vector requires an adversary to be authenticated as a NetworkManager or to compromise a system where such credentials exist. Once the role’s privileges are leveraged, the attacker can easily replace the database, elevating to Administrator without additional conditions.