4G and 5G Core Vulnerabilities: Defending Against Session Hijacking and DoS

Introduction

In a stark reminder that the telecommunications attack surface is expanding faster than our ability to secure it, researchers from Nanyang Technological University (NTU) in Singapore have dropped a bombshell: a widespread class of 84 security vulnerabilities impacting 4G and 5G core networks. These are not obscure edge-case bugs; they affect the very heart of modern connectivity—the Mobile Core (EPC and 5GC).

For CISOs and SOC managers managing critical infrastructure, the takeaway is urgent. Successful exploitation of these flaws allows attackers to trigger Denial-of-Service (DoS) conditions, effectively taking regions offline, and worse—session hijacking. This means an adversary can seize control of a user's network session, potentially intercepting data, bypassing authentication, or launching lateral attacks into the operator's internal network. Given the criticality of telecom services in 2026, we must treat this disclosure as a high-priority incident for vulnerability management teams.

Technical Analysis

Affected Products and Platforms

The research targets the core network functions of 4G LTE (Evolved Packet Core) and 5G (5G Core). While specific vendor implementations are often protected under disclosure embargoes, these issues are pervasive across the ecosystem, affecting hardware appliances from major vendors (e.g., Nokia, Ericsson, Huawei, Cisco) and software-based implementations like Open5GS and OAI.

Specific vulnerable components likely include:

• Mobility Management Entity (MME) / AMF (Access and Mobility Management Function): The control plane brain.
• S-GW / P-GW / UPF (User Plane Function): Data routing components.
• HSS / UDM (Unified Data Management): Database repositories for subscriber information.

Vulnerability Mechanics

The 84 identified flaws generally stem from improper input validation and missing integrity checks in signaling protocols.

1. Session Hijacking:

   • Attack Vector: Attackers manipulate signaling messages (e.g., GTP-C, Diameter, or HTTP/2 in 5G SBI). By injecting or modifying fields within these protocols, an attacker can confuse the core network into associating a legitimate user's International Mobile Subscriber Identity (IMSI) with a bearer controlled by the attacker.
   • Impact: Full takeover of user data sessions (IP interception), man-in-the-middle attacks, and unauthorized network access without subscriber credentials.

2. Denial-of-Service (DoS):

   • Attack Vector: Logic errors in the handling of transaction IDs or message sequencing. By sending malformed signaling packets, an attacker can trigger race conditions or resource exhaustion in the memory heaps of core network nodes.
   • Impact: Crashing critical nodes (MME/AMF), leading to service outages for thousands of subscribers in a geographic area.

Exploitation Status: As of July 2026, these vulnerabilities are disclosed via academic research. While there is no immediate confirmation of widespread nation-state exploitation in the wild, the publication of PoC code typically precipitates rapid scanning and exploitation by botnets and advanced threat actors within weeks. Defenders must assume active probing is imminent.

Detection & Response

Detecting attacks against the core network requires a shift from standard endpoint monitoring to protocol-aware network telemetry. Standard antivirus will not catch a malformed GTP-C packet. We need to look for anomalies in signaling traffic and unauthorized access to management interfaces.

SIGMA Rules

The following Sigma rules focus on detecting suspicious network traffic indicative of signaling plane abuse and potential management interface compromise.

---
title: Potential 4G/5G Core Signaling Anomaly - High Frequency GTP Traffic
id: 84f7e3a1-5c9d-4f2e-9b1c-8a6d5e4f3a2b
status: experimental
description: Detects a high volume of GTP (GPRS Tunneling Protocol) traffic, often indicative of DoS flooding or scanning attempts against the core network.
references:
  - https://ntu.edu.sg/research-description (Academic Source)
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.impact
logsource:
  category: network_connection
  product: firewalldetection:
  selection_gtp_ports:
    DestinationPort:
      - 2123 # GTP-C
      - 2152 # GTP-U
      - 3386 # GTP' (Prime)
  condition: selection_gtp_ports
falsepositives:
  - Legitimate high-traffic roaming events
  - Scheduled load testing
level: medium
---
title: Suspicious Access to Telecom Management Interfaces
id: 9a2b4c6d-8e1f-4a3b-9c5d-1e2f3a4b5c6d
status: experimental
description: Detects inbound connection attempts to known telecom management ports (SSH, Netconf, SNMP) from non-management IP ranges.
references:
  - https://ntu.edu.sg/research-description
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: firewalldetection:
  selection_mgmt_ports:
    DestinationPort:
      - 22   # SSH
      - 830  # NETCONF
      - 161  # SNMP
  selection_not_whitelist:
    SourceIP|contains:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: all of selection_*
falsepositives:
  - Legitimate administrator access from unknown IP
  - Monitoring system polling
level: high

KQL (Microsoft Sentinel)

This query hunts for anomalies in Diameter protocol traffic (port 3868), which is critical for 4G/5G AAA (Authentication, Authorization, and Accounting). A sudden spike or unique source IPs here can indicate probing for session hijacking vulnerabilities.

let TimeFrame = 1h;
let DiameterPorts = dynamic([3868, 5868]);
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where DestinationPort in (DiameterPorts)
| summarize Count = count(), DistinctSources = dcount(SourceIp) by Bin(Timestamp, 5m), DestinationIp, DestinationPort
| where Count > 1000 // Threshold tuning required based on baseline traffic
| project Timestamp, DestinationIp, DestinationPort, Count, DistinctSources
| order by Count desc

Velociraptor VQL

In a virtualized Network Function Virtualization (NFV) environment, we can hunt on the underlying Linux hosts for suspicious processes or unauthorized network listeners that might facilitate session hijacking.

-- Hunt for processes listening on signaling ports that are not part of the approved baseline
SELECT Pid, Name, Exe, Cmdline, ListenPorts
FROM listen_sockets()
WHERE ListenPorts.Port IN (2123, 2152, 3868, 36412)
  AND Name NOT IN ('open5gs-mmed', 'open5gs-sgwd', 'open5gs-pgwd', 'open5gs-smfd', 'mme', 'sgw', 'pgw')
  AND Exe NOT =~ '/opt/.*'

Remediation Script (Bash)

Use this script on Linux-based core network nodes to verify that critical signaling ports are not exposed globally and to check for recent unexpected crashes (logs) which might indicate attempted DoS exploitation.

#!/bin/bash
# Remediation/Hardening Check for 4G/5G Core Nodes
# Checks iptables/nftables for signaling port exposure and logs for segmentation faults

echo "[*] Checking 4G/5G Core Hardening Status..."

# Check for exposed GTP/Diameter ports
CRITICAL_PORTS=(2123 2152 3868)
EXPOSED_PORTS=()

for port in "${CRITICAL_PORTS[@]}"; do
    # Check if port is listening
    if netstat -tuln | grep -q ":$port "; then
        # Check if firewall allows traffic from non-loopback
        if iptables -L INPUT -n -v | grep -q "dpt:$port" && ! iptables -L INPUT -n -v | grep "dpt:$port" | grep -q "127.0.0.1"; then
            EXPOSED_PORTS+=("$port")
        fi
    fi
done

if [ ${#EXPOSED_PORTS[@]} -ne 0 ]; then
    echo "[!] ALERT: The following critical ports are potentially exposed: ${EXPOSED_PORTS[*]}"
    echo "[!] ACTION REQUIRED: Restrict these ports to trusted peer IPs only."
else
    echo "[+] OK: No critical signaling ports exposed globally."
fi

# Check logs for recent segfaults (DoS indicators)
echo "[*] Checking for recent service crashes (Segmentation Faults)..."
if journalctl --since "1 hour ago" | grep -qi "segfault\|segmentation fault"; then
    echo "[!] ALERT: Segmentation faults detected in system logs in the last hour."
    echo "[!] ACTION REQUIRED: Investigate core dumps and recent patches."
else
    echo "[+] OK: No recent segmentation faults detected."
fi

echo "[*] Hardening check complete."

Remediation

1. Patch Immediately: Contact your telecom equipment vendor (NEP) immediately. Apply the security patches released in response to the NTU research. If you are running open-source solutions like Open5GS, upgrade to the latest nightly build or stable release that addresses these logic flaws.

2. Network Segmentation: Ensure that the signaling plane (GTP-C, Diameter) is strictly isolated. These protocols should never be reachable from the public internet. Access Control Lists (ACLs) on edge firewalls must permit these ports only between known, authenticated peer nodes (e.g., MME to HSS, eNodeB to MME).

3. Enable Integrity Protection: For 5G Standalone (SA) cores, ensure that Horizontal Key Derivation and payload integrity protection are active for all N1, N2, and N3 interfaces.

4. Rate Limiting: Implement strict rate limiting on signaling messages per subscriber. A sudden burst of Create-Session-Requests from a single source (e.g., an eNodeB or gNodeB) is a primary indicator of DoS attempts.

5. Vendor Advisory Resources:

   • 3GPP SA3: Review the latest security specifications (TS 33.501) for signaling plane protection.
   • Vendor Security Bulletins: Check the portals of Cisco, Ericsson, Nokia, and Huawei for advisories dated July/August 2026 regarding "Session Management" and "Core Logic."

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub