CVE-2026-44473: Ella Networks Ella Core traffic redirection in NGAP handling

Executive brief

Ella Core, a software component used in private 5G networks, is vulnerable to a flaw that allows an attacker to intercept mobile device traffic. By sending a forged message from a connected radio, an attacker can trick the core network into redirecting a user's data downloads to the attacker's equipment. This could lead to unauthorized data access or a complete loss of service for the affected mobile user.

Technical details

Ella Core fails to verify that a PDUSessionResourceSetupResponse message arrives on the specific SCTP association bound to a User Equipment's (UE) logical NG-connection. An attacker with a valid NG Setup can send a forged response containing a target UE's AMF-UE-NGAP-ID. The core network then incorrectly creates a GTP tunnel towards the attacker's radio, redirecting all downlink user-plane traffic for that UE. This vulnerability is classified under CWE-358 (Improperly Implemented Security Check) and CWE-863 (Incorrect Authorization). A fix is available in version 1.10.0 which scopes UE context lookups to the sending radio's SCTP association.

Affected products

• Ella Networks core < 1.10.0

Timeline

• 2026-05-06: disclosed
• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-27: other: NVD published

References

• https://api.github.com/users/SJNA0414
• https://github.com/SJNA0414
• https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D
• https://api.github.com/users/SJNA0414/repos
• https://avatars.githubusercontent.com/u/197385222?v=4
• https://api.github.com/users/SJNA0414/events%7B/privacy%7D