CVE-2026-44473: Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

Synopsis

This is an authentication bypass and session-hijacking flaw in Ella Core, a 5G core network implementation designed for private networks. An attacker operating on the same adjacent network (LAN or equivalent radio-access segment) who has completed a valid NG Setup can forge a PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID; Ella Core fails to verify that the message arrived on the correct SCTP association for that UE, and so accepts it. Successful exploitation lets the attacker redirect a victim UE's downlink GTP tunnel to a radio they control, exposing the UE's network traffic and disrupting that UE's connectivity. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment (such as a LAN or radio-access network) and must have completed a valid NG Setup with the target Ella Core instance.

• AuthenticationNot required

  No credentials are required beyond possessing a valid NG Setup association, which any enrolled radio can establish.

• Victim interactionNot required

  The UE whose session is hijacked does not need to take any action; exploitation is fully passive from the victim's perspective.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has an NG Setup association; no race conditions or special memory-layout knowledge are needed.

Blast Radius

• Reads downlink traffic destined for the targeted UE by redirecting the GTP tunnel to an attacker-controlled radio, exposing unencrypted or weakly encrypted application-layer data.
• Disrupts the targeted UE's active data session, causing loss of connectivity for the duration of the hijack.
• Enables the attacker to act as a downlink man-in-the-middle for the affected UE, potentially injecting or dropping packets in that session.