Researchers from Singapore’s Nanyang Technological University have published findings on 84 security vulnerabilities they discovered across seven open-source 4G and 5G core network implementations. The vulnerabilities share a single root cause: components inside cellular core networks blindly trust messages from internal peers without validating that those peers are actually authorized. The researchers call this class of bug an “implicit trust error” (iTrue), and they found it present in two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF). The flaws affect signaling interfaces running two core protocols: GTP-C (GPRS Tunnelling Protocol Control Plane) and PFCP (Packet Forwarding Control Protocol).
The practical risk depends on an attacker’s ability to reach those internal interfaces — historically protected by physical isolation. As carriers move to cloud-native deployments, however, that physical isolation disappears, and previously internal network functions become potentially reachable from the internet. When that happens, an attacker who can reach a vulnerable interface can send malformed or malicious signaling messages that trigger denial-of-service or, in the worst case, full session hijacking — seizing control of a legitimate user’s active network session. To find and confirm these flaws, the researchers built an LLM-assisted multi-agent framework called iFinder that summarizes known vulnerabilities, builds detection patterns, discovers new iTrues in production code, and generates proof-of-concept exploits to validate them. The research is particularly significant because open-source 5G core implementations are widely used in both academic test environments and commercial deployments.