CVE-2026-44474

{
  "id": "CVE-2026-44474",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T17:16:39.220",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0."
    },
    {
      "lang": "es",
      "value": "Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.10.0, Ella Core no aplicaba reglas de seguridad sobre la ejecución concurrente de procedimientos de seguridad definidos en TS 33.501 §6.9.5.1 - podía enviar un comando de modo de seguridad NAS mientras una transferencia N2 aún estaba pendiente (y viceversa). El comando de modo de seguridad concurrente y la transferencia N2 producen un desajuste de KgNB entre el UE y el gNB objetivo, lo que provoca que la transferencia falle. Requiere un gNB estancado más una condición de carrera de re-registro para activarse. Esta vulnerabilidad está corregida en la versión 1.10.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ellanetworks",
          "product": "core",
          "versions": [
            {
              "version": "< 1.10.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T17:22:21.103731Z",
          "id": "CVE-2026-44474",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-358"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q",
      "source": "[email protected]"
    }
  ]
}