Executive brief
Ella Core is a 5G core platform used to manage private cellular networks. A security flaw allows authorized network managers to modify subscriber policies while tricking the system's audit logs into recording the wrong identity. This could allow a malicious administrator to disrupt service for specific users while avoiding detection during a security audit.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Ella Core 5G platform's subscriber update API. The 'PUT /api/v1/subscriber/{imsi}' endpoint accepts the International Mobile Subscriber Identity (IMSI) in both the URL path and the JSON request body but fails to validate that these identifiers match. An attacker with NetworkManager or Admin privileges can exploit this by providing a target IMSI in the URL path and a different, potentially non-existent IMSI in the request body. This results in the policy modification being applied to the target subscriber while the audit log incorrectly records the action against the IMSI provided in the body, effectively bypassing forensic accountability. The issue is resolved in version 1.8.0 by using the path parameter as the single source of truth.
Affected products
- Ella Networks Ella Core < 1.8.0
Timeline
- 2026-03-30: patched: Version 1.8.0 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD