Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

中 6.1CVE-2026-44475 · GHSA-pwfh-mqp3-pqwj · GO-2026-5554 · 27/05/2026 公開 · 26/10/2026 更新

要点

CVE-2026-44475 は github.com/ellanetworks/core に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.15%（全脆弱性の 4.0% より高い）。
対処：1.10.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/ellanetworks/core Go	`< 1.10.0`	`1.10.0`

概要

Summary

Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest.

Impact

A gNB can corrupt Ella Core's stored UE security capabilities for a target UE.

Fix

The PathSwitchRequest handler now compares the received UE Security Capabilities against Ella Core's locally stored values, preserves the stored values on mismatch, returns them in the PathSwitchRequestAcknowledge, and logs the event.

NVD の説明

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.