Ella Core Denial-of-Service Vulnerability in UL NAS Transport Message Processing

A denial-of-service vulnerability has been identified in Ella Core versions prior to 1.6.0. The issue arises when the application processes malformed UL NAS Transport messages that lack a Request Type. An attacker can exploit this vulnerability by sending crafted NAS messages to Ella Core, causing the application to panic and crash. This disruption affects all connected subscribers, and no authentication is required to exploit the vulnerability.

Impact

Exploitation of this vulnerability leads to a process crash, causing service disruption for all connected subscribers.

Remediation

Users can upgrade to Ella Core version 1.6.0 or later, where this vulnerability has been patched.