Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the handling of PDUSessionResourceSetupResponse messages carrying AMF-UE-NGAP-ID. An attacker can redirect downlink user-plane traffic for any targeted UE to their own radio by sending a forged message with a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the handling of PDUSessionResourceSetupResponse messages carrying AMF-UE-NGAP-ID. An attacker can redirect downlink user-plane traffic for any targeted UE to their own radio by sending a forged message with a...

PT-2026-39667

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.10.0 Description A radio with a valid NG Setup can send a forged 'PDUSessionResourceSetupResponse' carrying any UE's AMF-UE-NGAP-ID. The software fails to verify if the message arrived on the SCTP association boun...