7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44473

CVE-2026-44473: Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

Summary

A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio.

Impact

Downlink user-plane traffic for the targeted UE is redirected to the attacker's radio.

Fix

UE context lookups are now scoped to the sending radio's SCTP association.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44473

CVE-2026-44473:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ellanetworks/core	go	< 1.10.0	1.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper validation of UE (User Equipment) context ownership within multiple NGAP (Next Generation Application Protocol) message handlers in Ella Core's AMF (Access and Mobility Management Function). The core issue was that when processing certain NGAP messages, the system would look up the UE context using an identifier (AMF-UE-NGAP-ID) provided by a radio, but it failed to verify that the identified UE was actually associated with the specific radio that sent the message. The lookup was performed in a global scope across all connected radios.

An attacker with control of a valid, connected radio could exploit this by sending a forged NGAP message, such as PDUSessionResourceSetupResponse, containing the AMF-UE-NGAP-ID of a victim UE. The AMF would find the victim's UE context and incorrectly associate it with the attacker's radio, effectively hijacking the UE's data session. This would cause all subsequent downlink traffic intended for the victim to be redirected to the attacker's radio.

The patch addresses this by changing the UE lookup mechanism. Instead of performing a global search, the updated code scopes the search to the specific radio instance that received the NGAP message. This is achieved by introducing a new resolveUE function and modifying existing handlers to use radio-specific lookup methods (e.g., ran.FindUEByAmfUeNgapID instead of amfInstance.FindRanUeByAmfUeNgapID). This ensures that a radio can only manipulate UE contexts that are legitimately under its control, preventing the cross-radio session hijacking attack.

Vulnerable functions

ngap.HandlePDUSessionResourceSetupResponse

internal/amf/ngap/handle_pdu_session_resource_setup_response.go

The function used a global UE lookup (`amfInstance.FindRanUeByAmfUeNgapID`) based on the AMF-UE-NGAP-ID from the message, without verifying that the UE belongs to the radio that sent the message. This allowed an attacker's radio to impersonate a legitimate UE and hijack its session by sending a forged `PDUSessionResourceSetupResponse`. The subsequent line `ranUe.Radio = ran` would then incorrectly associate the victim's UE context with the attacker's radio.

ngap.HandlePDUSessionResourceModifyResponse

internal/amf/ngap/handle_pdu_session_resource_modify_response.go

Similar to `HandlePDUSessionResourceSetupResponse`, this function was vulnerable because it performed a global lookup for the UE context using `amfInstance.FindRanUeByAmfUeNgapID` and did not validate that the UE was associated with the reporting radio. This could allow an attacker to hijack a UE's session by forging a `PDUSessionResourceModifyResponse`.

ngap.HandleUEContextModificationFailure

internal/amf/ngap/handle_ue_context_modification_failure.go

This function was vulnerable as it used a global `amfInstance.FindRanUeByAmfUeNgapID` lookup. An attacker could send a forged `UEContextModificationFailure` message for a UE on a different radio, potentially causing denial of service or other state inconsistencies for the victim UE by having its context incorrectly modified or associated with the attacker's radio.

ngap.HandleUEContextModificationResponse

internal/amf/ngap/handle_ue_context_modification_response.go

The function was vulnerable due to the use of a global UE context lookup (`amfInstance.FindRanUeByAmfUeNgapID`). This allowed a malicious radio to forge a `UEContextModificationResponse` for any UE, leading to incorrect state updates and potential session hijacking by associating the UE with the attacker's radio.

ngap.HandleHandoverFailure

internal/amf/ngap/handle_handover_failure.go

The function used a global lookup `amfInstance.FindRanUeByAmfUeNgapID` to find the target UE during a handover failure. This allowed a malicious radio to interfere with the handover procedure of any UE by sending a forged `HandoverFailure` message, causing the system to incorrectly update the UE's state or associate it with the wrong radio.

ngap.HandleHandoverRequestAcknowledge

internal/amf/ngap/handle_handover_request_acknowledge.go

This handler was vulnerable because it located the UE using a global lookup (`amfInstance.FindRanUeByAmfUeNgapID`) instead of one scoped to the radio. A malicious radio could acknowledge a handover for a UE it doesn't own, potentially hijacking the UE's session and redirecting its traffic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.