Ella Core NGAP Message Processing Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Ella Core versions prior to 1.6.0. The issue arises when the software processes NGAP messages containing invalid PDU Session IDs outside the range of 1 to 15, leading to a process crash. This disruption affects all connected subscribers, causing a significant service outage. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability causes the process to crash, disrupting service for all connected subscribers.

Remediation

Users can upgrade to Ella Core version 1.6.0 or later, where this vulnerability has been addressed by adding PDU Session ID validations during NGAP message handling.