Artificial Intelligence Agents Discover 84 Dangerous Vulnerabilities in 4G and 5G Networks

Scientists at Nanyang Technological University (NTU) in Singapore have uncovered 84 previously unknown vulnerabilities in the open-core software of 4G and 5G networks. According to an August 11 report by Help Net Security, most of these security flaws, identified with the help of a new artificial intelligence-powered system, have been confirmed, highlighting the importance of protecting modern mobile networks from cyberthreats. According to Ixbt.com the report says.

The research team developed a multi-agent system called iFinder to automatically search for security flaws. The system relies on large language models. iFinder analyzes known vulnerabilities, converts their characteristics into search patterns, and checks source code for suspicious errors. In a subsequent step, the identified variants are compared with the specifications of the 3GPP international mobile communications standards.

Artificial Intelligence and Automated Analysis

The system's next agent creates a proof of concept (Proof of Concept, or PoC) demonstrating the possibility of exploiting a vulnerability and tests it iteratively in network software. It is important to note that the automated search process was not error-free: in a benchmark set, iFinder found 15 of 22 already known vulnerabilities, while nearly one-quarter of the candidates turned out to be false positives. All findings sent to developers were manually verified and reproduced by the team.

According to the published report, developers confirmed 83 vulnerabilities, 81 of which received standardized CVE identifiers. At the time this information was published, 58 of the confirmed issues had already been fixed, but patches had not yet been released for 23 vulnerabilities with CVE identifiers.

"Confused Trust" Errors and Dangerous Attacks

Most of the identified issues belong to a class the authors call "confused trust errors." Components of a mobile network core may accept signaling messages from neighboring functions without adequately checking their syntax, meaning, and requested resources. Previously, such interfaces were protected by the physical isolation of components, but the migration of network cores to cloud infrastructure is creating additional opportunities to access internal interfaces.

The study analyzed open cores for LTE and 5G networks, including Open5GS, OpenAirInterface, free5GC, SD-Core, and eUPF. The most serious attack identified involved replacing a routing rule identifier while increasing its priority. If the attack succeeds, the user plane function can redirect a subscriber's outgoing traffic to an address controlled by the attacker, thereby hijacking the subscriber's session.

The authors note that this vulnerability was also confirmed in commercial 5G cores. However, carrying out the attack requires access to internal signaling interfaces. The iFinder developers emphasize that detecting a vulnerability alone cannot replace checking specifications, reproducing the attack, and fixing the issue.