A Nanyang Technological University team reported 84 previously unknown flaws across seven open-source 4G and 5G core implementations after using an LLM-assisted multi-agent system. The July 11 paper says 83 findings were confirmed and 81 received CVE identifiers; Help Net Security reported on August 11 that 23 confirmed flaws still lacked a code fix.
Researchers at Singapore's Nanyang Technological University (NTU) reported 84 previously unknown security vulnerabilities across seven open-source implementations of 4G and 5G core networks. Their July 11 paper says developers had confirmed 83 findings and 81 had received CVE identifiers. Help Net Security reported on August 11 that 58 confirmed flaws had been patched while 23 confirmed, CVE-assigned findings still lacked a code change.
The researchers call the recurring flaw class implicit trust errors, or iTrues. Components inside a cellular core may accept signaling messages from peer functions without fully validating their syntax, semantics, or resource requests. That assumption was less exposed when core systems were physically isolated, but cloud deployments can make formerly internal interfaces reachable through misconfiguration or boundary failures.
From patterns to working exploits
The team built iFinder, an LLM-assisted multi-agent system that summarizes known flaws, turns them into detection patterns, and searches code for related weaknesses. A second stage cross-checks candidates against 3GPP specifications and the implementation to identify protections the model may have missed. Another stage generates and iteratively tests proof-of-concept exploits against a network implementation.
The paper evaluated Open5GS and OpenAirInterface for LTE, plus Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF for 5G. It covered signaling over the GPRS Tunnelling Protocol control plane and the Packet Forwarding Control Protocol.
This workflow did not eliminate false positives. Help Net Security reported that iFinder detected 15 of 22 previously known flaws in an evaluation set and that roughly one quarter of its reported candidates were wrong. The researchers said every finding sent to maintainers was manually reviewed, reproduced, and accompanied by a working proof of concept.
Session hijacking reached commercial cores
The most serious reported scenario reuses a forwarding-rule identifier with higher priority so a user-plane function sends a subscriber's uplink traffic toward an attacker-controlled endpoint. The paper says the session-hijacking flaw was confirmed on commercial 5G cores. The Hacker News reported that successful exploitation requires access to internal signaling interfaces, whether through exposed infrastructure, misconfiguration, or a boundary-bypassing route.
For telecom and private-network teams, the practical lesson is broader than the number of CVEs. Internal service boundaries need explicit sender, state, semantic, uniqueness, and resource validation even when the protocol was designed for a trusted zone. AI can expand review coverage, but reproducible exploits, specification checks, maintainer triage, and patch verification remain the controls that turn an automated candidate into an actionable vulnerability.
Key Points #
- 1NTU's iFinder found 84 previously unknown flaws across seven open-source 4G and 5G core implementations; the paper reports 83 confirmations and 81 CVE assignments.
- 2The implicit-trust flaw class can enable denial of service and, in a severe case validated on commercial 5G cores, subscriber-session hijacking.
- 3The LLM-assisted system cross-checks specifications and code and iteratively tests exploits, but manual reproduction and maintainer validation remain necessary.
Scoring Rationale #
The research identifies a broad flaw class across seven cellular-core implementations and validates a session-hijacking path on commercial 5G systems. It also demonstrates a reproducible agent-assisted security workflow, while measured false positives and incomplete patching make human verification essential.
Sources #
Primary source and supporting public references used for this report.
Practice with real Telecom & ISP data
90 SQL & Python problems · 15 industry datasets
[Active Residential CustomersEasy](/problems/sql/active-residential-customers)
[Unlimited Fiber Plans 500Mbps+Medium](/problems/sql/unlimited-fiber-plans-above-500mbps)
[Customer Churn Risk AssessmentHard](/problems/sql/customer-churn-risk-assessment)
250 free problems · No credit card
See all Telecom & ISP problems