CVE-2026-33281: fallo de gravedad media en ellanetworks core
Ella Core panics on invalid PDU Session IDs in NGAP messages
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with invalid PDU Session IDs outside of 1-15. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added PDU Session ID validations during NGAP message handling.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
ellanetworks · coreCVEs relacionadas — ellanetworks core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-33282HIGHElla Core panics on malformed NGAP Location ReportEPSS 0.4%CVE-2026-33906HIGHElla Core has Privilege Escalation via Database Restore by NetworkManager roleEPSS 0.4%CVE-2026-33283MEDIUMElla Core panics on malformed ULNASTransport Message without a Request TypeEPSS 0.4%CVE-2026-34761MEDIUMElla Core Panics Upon NGAP handover failureEPSS 0.3%CVE-2026-32319HIGHElla Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payloadEPSS 0.3%CVE-2026-33907MEDIUMElla Core Panics during NAS Authentication Response/Failure with missing IEsEPSS 0.2%