| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ellanetworks/core | < 1.10.0 | 1.10.0 |
A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio.
Downlink user-plane traffic for the targeted UE is redirected to the attacker's radio.
UE context lookups are now scoped to the sending radio's SCTP association.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free