Executive Summary
Recent academic research from Nanyang Technological University has exposed a systemic security weakness in 4G and 5G cellular core networks (CN) termed 'Implicit Trust Errors' (iTrue). These vulnerabilities stem from a legacy architectural assumption of physical isolation, where internal network functions blindly trust incoming signaling messages without sufficient syntactic or semantic validation. As carriers migrate to cloud-native environments, this trusted perimeter is often breached through cloud misconfigurations or protocol tunneling, exposing internal interfaces to external adversaries.
The study analyzed seven prominent open-source implementations, including Open5GS and free5GC, uncovering 84 previously unknown vulnerabilities. Critical findings include a session-hijacking flaw in the Packet Forwarding Control Protocol (PFCP) confirmed in real-world commercial 5G networks, which allows attackers to redirect a victim's uplink traffic. Additionally, numerous denial-of-service (DoS) vectors were discovered in GPRS Tunnelling Protocol Control Plane (GTP-C) handlers. These findings represent a significant risk to carrier infrastructure, as many production networks lack mutual authentication and strict boundary enforcement on internal interfaces.
Urgent remediation is required for mobile network operators and equipment vendors. The research highlights that these are not isolated implementation bugs but a systemic failure to adapt legacy trust models to modern, cloud-integrated deployments. Organizations should prioritize patching and move toward a zero-trust architecture for internal core signaling.