The vulnerability arises when Ella Core fails to enforce security rules for concurrent execution of security procedures defined in TS 33.501 §6.9.5.1. This flaw is a race condition (CWE-358). This allows a NAS Security Mode Command to be sent while an N2 handover is still pending, or vice versa. The resulting KgNB mismatch between the UE and the target gNB causes the handover to fail, leading to disrupted connectivity for affected UEs.

Ella Core deployments built with any version prior to 1.10.0 are affected. The issue is present in the private‑network 5G core software released by Ellanetworks.

The CVSS score of 3.7 indicates a moderate impact. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The attack requires a specific race condition involving a stalled gNB and a UE re‑registration, implying a higher expertise level and a low probability of exploitation under normal operational conditions. The likely attack vector is an internal race condition rather than a remote attack surface. Consequently, the overall risk to organizations is considered moderate but warrants remediation to prevent potential service disruption.