A radio equipped with a valid NG Setup can send a forged PDUSessionResourceSetupResponse that carries any UE's AMF-UE-NGAP-ID. Ella Core does not verify that the message arrived on the SCTP association bound to the target UE’s logical NG‑connection, and consequently it creates a GTP tunnel toward that radio. The flaw allows an attacker to create a rogue GTP tunnel which can redirect or intercept user traffic. The weakness is a failure to verify the source of a critical control message (CWE‑358) and improper handling of identifiers (CWE‑863).

Ella Core, a 5G core platform developed by Ellanetworks. All deployments running a version prior to 1.10.0 are impacted, as the vulnerability is fixed in 1.10.0 and later releases. The vulnerability concerns the radio interface of the core, not the network element’s operating system.

The CVSS score of 7.1 indicates a high severity potential impact on confidentiality, integrity, or availability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not currently a widely exploited vulnerability. The attack vector is remote, requiring an attacker to act as a radio that can transmit forged messages over the NG interface. Successful exploitation could allow the attacker to redirect user traffic, perform man‑in‑the‑middle attacks, or gain unauthorized access to user data. The lack of an official workaround means the only reliable mitigation is to upgrade to the patched version.