PT-2026-28565 · Ella Core · Ella Core

Published 2026-03-26 · Updated 2026-04-07 · CVE-2026-33907

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.7.0

Description Ella Core, a 5G core designed for private networks, experiences a panic when processing Authentication Response and Authentication Failure NAS messages lacking Information Elements (IEs). An attacker can exploit this by sending crafted NAS messages to Ella Core, leading to a process crash and service disruption for all connected subscribers. No authentication is required to send these messages. The issue is resolved by adding IE presence verification to NAS message handling.

Recommendations Update to version 1.7.0 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-33907

GHSA-55Q8-2GWX-29PC

GO-2026-4872

SUSE-SU-2026:1205-1

Affected Products

Ella Core

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33907.json · Exploit
• https://github.com/ellanetworks/core/security/advisories/GHSA-55q8-2gwx-29pc · Vendor Advisory
• https://github.com/ellanetworks/core/commit/52962660e3bd3e23c7e96b0da270ac1e0e705273 · Patch
• https://osv.dev/vulnerability/GO-2026-4872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33907 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33907 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55q8-2gwx-29pc · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://github.com/ellanetworks/core · Note
• https://github.com/ellanetworks/core/releases/tag/v1.7.0 · Note
• https://suse.com/security/cve/CVE-2026-33748 · Note
• https://suse.com/security/cve/CVE-2026-34042 · Note
• https://suse.com/security/cve/CVE-2026-34388 · Note
• https://suse.com/security/cve/CVE-2026-34386 · Note
• https://suse.com/security/cve/CVE-2026-34385 · Note