Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
Summary: Researchers at Singapore's Nanyang Technological University published a study reporting 84 previously unknown vulnerabilities in the signaling interfaces of 4G and 5G core networks, of which 83 are confirmed and 81 have CVE identifiers. The flaws share a single root cause the authors call implicit trust errors (iTrue) - core network functions blindly acting on messages from internal peers - and were found across seven open-source LTE/5G implementations using an LLM-assisted multi-agent system named iFinder.
Bottom line: The session hijacking flaw was found in two real-world commercial 5G core networks; Dotouch fixed it in XproUPF as CVE-2026-8233, while a second unnamed major 5G carrier is still remediating, and the same underlying defect appears independently in OpenAirInterface and eUPF.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026