Prior to version 1.10.0, the 5G core software does not verify the UE Security Capabilities field in NGAP PathSwitchRequest messages against its locally stored values. This shortcoming allows a malicious gNB to send a single crafted PathSwitchRequest that overwrites the stored UE security capabilities for any user equipment with arbitrary values, potentially enabling unauthorized network access or weakening the security posture of the core.

Ella Networks Core 5G implementations older than version 1.10.0 are affected. All deployments using these versions are susceptible to this capability bypass, regardless of the number of user equipments connected.

The CVSS score of 6.1 indicates medium severity, and the vulnerability is not currently listed in the CISA KEV catalog, but an attacker who controls or compromises a gNB can exploit it via the air interface. Exploitation requires knowledge of the correct message format and the ability to inject a PathSwitchRequest; no remote code execution or privilege escalation on the core software itself is needed. The EPSS score is not available, so the current likelihood of exploitation is unknown.