Researchers from Nanyang Technological University have published a study on a weakness class they call implicit trust errors in 4G and 5G core networks. The short version: parts of the mobile core still behave as if anything reaching internal signaling interfaces is already trusted. That assumption made more sense when carrier cores were physically isolated. It becomes brittle when those functions are virtualized, cloud-hosted, integrated with partners, or misconfigured in ways that expose internal control-plane paths.

The research, reported by The Hacker News and detailed in the paper Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis, identified 84 previously unknown vulnerabilities across seven open-source LTE and 5G core implementations. According to the paper, 83 have been confirmed and 81 have received CVE identifiers. The more important takeaway is not the raw count; it is the recurring pattern behind them.

What happened

The researchers examined core network signaling protocols including GTP-C and PFCP across Open5GS, OpenAirInterface, free5GC, SD-Core, and eUPF. Their finding was that multiple core components accepted messages from peer functions without enough validation of format, semantics, uniqueness, or resource availability.

That blind trust can create denial-of-service conditions when malformed or unexpected control-plane messages crash a component. In more serious cases, it can allow session hijacking. One demonstrated pattern involved manipulating PFCP session rules so a user plane function prioritized an attacker-controlled forwarding rule over the legitimate one, causing victim traffic to be redirected.

This is not a “random internet exploit hits every phone tomorrow” situation. The attack path still depends on reachability into interfaces that should normally be protected. But that is exactly why the finding matters: cloud-native telecom deployments, lab-to-production reuse, exposed management networks, weak segmentation, and partner connectivity can all turn “internal only” assumptions into real attack surface.

Why this matters for defenders

Telecom core networks are critical infrastructure, but the lesson applies far beyond carriers. Many enterprise systems still rely on inherited trust boundaries: backend APIs that trust east-west traffic, admin planes that assume VPN access equals authorization, service meshes with overly broad peer trust, and legacy protocols lifted into cloud environments without redesigning validation.

The uncomfortable pattern is familiar: a system is secure as long as the network boundary holds perfectly. Once an attacker lands inside that boundary, or once a service is accidentally reachable, components accept too much and verify too little.

Defensive takeaways

  • Inventory internal control-plane interfaces. Know which GTP, PFCP, management, API, and orchestration endpoints exist, where they listen, and which networks can reach them.
  • Do not rely on “internal” as an authorization control. Require explicit peer identity, authentication, and message validation between sensitive components.
  • Segment telecom and critical service planes aggressively. Separate user-plane, control-plane, management, monitoring, and orchestration traffic instead of treating the environment as one flat trusted zone.
  • Monitor for malformed or unexpected signaling traffic. Crashes, unusual association requests, duplicate rule identifiers, or unexpected PFCP/GTP-C message patterns should be treated as security signals, not just operational noise.
  • Patch open-source and vendor core components quickly. Open-source mobile cores are widely used in labs, private 5G, research environments, and some commercial deployments. Lab systems often become production-adjacent faster than teams expect.
  • Threat-model cloud migration separately. Moving a carrier-grade or industrial system into cloud infrastructure changes who can reach what. Revalidate assumptions instead of inheriting old diagrams.

Bulwark Black assessment

This research is a clean example of why “zero trust” should not just mean user logins and SaaS access. The same principle applies inside infrastructure: every sensitive component should validate who is talking to it, whether the message is well formed, whether the requested state change makes sense, and whether accepting it would break a security invariant.

For government contractors, telecom-adjacent providers, managed service providers, and organizations deploying private 5G, the priority is not panic. It is boundary review. If a system assumes that internal control traffic is automatically safe, that assumption deserves a fresh look.

Original source: The Hacker News — Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

Research paper: arXiv: Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis