CVE-2026-44475

{
  "id": "CVE-2026-44475",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T17:16:39.360",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0."
    },
    {
      "lang": "es",
      "value": "Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la 1.10.0, Ella Core no verifica las capacidades de seguridad del UE recibidas en los mensajes NGAP PathSwitchRequest frente a sus valores almacenados localmente. Un gNB malicioso puede sobrescribir las capacidades de seguridad del UE almacenadas en Ella Core para cualquier UE con valores arbitrarios enviando un único PathSwitchRequest manipulado. Esta vulnerabilidad está corregida en la 1.10.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ellanetworks",
          "product": "core",
          "versions": [
            {
              "version": "< 1.10.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T15:35:53.555635Z",
          "id": "CVE-2026-44475",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-358"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj",
      "source": "[email protected]"
    }
  ]
}