PT-2026-29709 · Ella Core · Ella Core

Offset · Published 2026-04-01 · Updated 2026-04-03 · CVE-2026-34762

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.8.0

Description The PUT /api/v1/subscriber/{imsi} API endpoint accepts an IMSI identifier from both the URL path and the JSON request body without verifying they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. An attacker can modify a subscriber's Quality of Service (QoS) policy, potentially degrading service or altering traffic routing, while the audit log attributes the change to a non-existent or unrelated subscriber.

Recommendations Update to version 1.8.0 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-34762

GHSA-XW45-CC32-442F

Affected Products

Ella Core

References · 7

• https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xw45-cc32-442f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34762 · Security Note
• https://github.com/ellanetworks/core · Note
• https://github.com/ellanetworks/core/commit/7f64b7a7c7a22cb9c05ac2c1c3a0cf0eaefac3e5 · Note
• https://github.com/ellanetworks/core/releases/tag/v1.8.0 · Note
• https://twitter.com/CVEnew/status/2040128774012809681 · Twitter Post