CVE-2026-44473

{
  "id": "CVE-2026-44473",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T17:16:39.070",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0."
    },
    {
      "lang": "es",
      "value": "Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.10.0, una radio con una configuración NG válida puede enviar una respuesta PDUSessionResourceSetupResponse falsificada que transporta el AMF-UE-NGAP-ID de cualquier UE. Ella Core no verifica que el mensaje llegó a la asociación SCTP vinculada a la conexión NG lógica de ese UE, luego crea un túnel GTP hacia esa radio. Esta vulnerabilidad está corregida en la versión 1.10.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ellanetworks",
          "product": "core",
          "versions": [
            {
              "version": "< 1.10.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T14:33:19.699329Z",
          "id": "CVE-2026-44473",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-358"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v",
      "source": "[email protected]"
    }
  ]
}