{"id":"EUVD-2026-32563","enisaUuid":"cb43d09f-7826-384a-a294-7e3c3b9f8436","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE\u0027s AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE\u0027s logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:16:05 PM","dateUpdated":"May 28, 2026, 2:33:35 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v\n","aliases":"CVE-2026-44473\nGHSA-qfxw-v8qx-vj3v\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"a95b3b13-6364-322b-aa09-7d5d297fddfe","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"enisaIdVendor":[{"id":"144da3b8-ec99-3c79-9a2e-d64248d59b1c","vendor":{"name":"ellanetworks"}}],"enisaIdVulnerability":[{"id":"ccafb0d0-4e3a-33e1-a229-0ab26ebc7c01","vulnerability":{"id":"GHSA-qfxw-v8qx-vj3v","description":"Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse","datePublished":"May 11, 2026, 3:18:47 PM","dateUpdated":"Jun 8, 2026, 11:48:51 PM","baseScore":0.0,"references":"https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44473\nhttps://github.com/ellanetworks/core\n","enisa_id":"EUVD-2026-32563\n","aliases":"GHSA-qfxw-v8qx-vj3v\nCVE-2026-44473\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e1f71741-bd29-33c1-b1c8-cd65c70e0762","vulnerability":{"id":"CVE-2026-44473","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE\u0027s AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE\u0027s logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:16:05 PM","dateUpdated":"May 28, 2026, 2:33:35 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v\n","enisa_id":"EUVD-2026-32563\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"daec51a8-edf8-3f5d-83c2-e0021b3c0987","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"vulnerabilityVendor":[{"id":"6adec45f-eb19-325d-9bc0-a80f284485cb","vendor":{"name":"ellanetworks"}}]}}],"enisaIdAdvisory":[]}