6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44475

CVE-2026-44475: Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

Summary

Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest.

Impact

A gNB can corrupt Ella Core's stored UE security capabilities for a target UE.

Fix

The PathSwitchRequest handler now compares the received UE Security Capabilities against Ella Core's locally stored values, preserves the stored values on mismatch, returns them in the PathSwitchRequestAcknowledge, and logs the event.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44475

CVE-2026-44475:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ellanetworks/core	go	< 1.10.0	1.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided vulnerability information, which indicated a security capability bypass in the NGAP PathSwitchRequest handler. The first step was to identify the relevant code changes by comparing the vulnerable and patched versions of the ellanetworks/core repository. By analyzing the commits between the last vulnerable version and the first patched version, I was able to pinpoint the exact functions that were modified to address the security issue.

The primary vulnerable function identified is HandlePathSwitchRequest. The evidence from the patch shows that a new verification step was added to this function to compare the UE security capabilities received in the PathSwitchRequest with the locally stored values. The absence of this check in the vulnerable version is the root cause of the vulnerability described in the advisory.

Additionally, the analysis of the commits revealed a second, related vulnerability in the AmfUe.SelectSecurityAlg function. This function was found to default to null security algorithms if the UE's security capabilities were not available. This represents a significant security risk, as it could lead to unencrypted and unauthenticated communication. Although not the primary focus of the advisory, this function was also patched in the same release and is included in the analysis as a relevant security finding.

Both of these functions would appear in a runtime profile during the exploitation of these vulnerabilities, making them key indicators for detection and a priority for patching.

Vulnerable functions

HandlePathSwitchRequest

internal/amf/ngap/handle_path_switch_request.go

This function processes NGAP Path Switch Request messages. The vulnerability lies in the fact that it did not verify the UE Security Capabilities provided in the message. A malicious gNB could send a crafted PathSwitchRequest with downgraded security capabilities, and the core network would accept them, weakening the security of the UE's connection.

AmfUe.SelectSecurityAlg

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.