PT-2026-26467 · Ella Core · Ella Core

P1-Aji

·

Publicado

2026-03-19

·

Atualizado

2026-03-27

·

CVE-2026-33281

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.6.0
Description Ella Core, a 5G core designed for private networks, experiences a panic when processing NGAP messages containing invalid PDU Session IDs outside the range of 1-15. An attacker capable of sending specially crafted NGAP messages to Ella Core can cause a process crash, leading to service disruption for all connected subscribers. No authentication is required to exploit this issue. The vulnerability is related to insufficient validation of PDU Session IDs during NGAP message handling.
Recommendations Update to version 1.6.0 or later, which includes PDU Session ID validations during NGAP message handling.

Exploit

Correção

Improper Validation of Array Index

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2026-33281
GHSA-Q669-4GMV-G8MF
GO-2026-4783
SUSE-SU-2026:1135-1

Produtos afetados

Ella Core