Technical Summary: Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis

1. Problem Statement

Cellular Core Networks (CNs) are critical infrastructure historically secured by physical isolation, operating under an implicit trust model where internal interfaces between network functions are assumed to be safe and free from malicious traffic. However, the migration of CNs to cloud-native deployments has eroded this physical perimeter. Misconfigurations and architectural shifts now allow external adversaries to reach previously internal interfaces (e.g., via GTP-U tunnel abuse or cloud misconfigurations).

The paper identifies a systemic vulnerability pattern termed Implicit Trust Errors (iTrue). Through a root-cause analysis of GitHub issues in open-source CN implementations, the authors found that components frequently fail to validate messages received from internal peers. These failures manifest in three recurring categories:

1. Missing Syntactic Validation: Failure to check for mandatory fields, basic format, or length constraints.
2. Missing Semantic Validation: Failure to enforce state-dependent invariants or validate value ranges.
3. Missing Resource Availability Checks: Failure to verify resource availability before allocation.

When internal interfaces become externally reachable, these "blind trust" assumptions lead to severe consequences, including Denial of Service (DoS) and session hijacking. Existing security research has largely focused on the User Equipment (UE) to CN boundary (NAS/NGAP) or the GTP-U user plane, leaving the internal control-plane communication (PFCP, GTP-C) systematically underexplored.

2. Methodology: The iFinder System

To address the challenge of discovering these vulnerabilities at scale while mitigating the hallucinations common in Large Language Model (LLM) analysis, the authors designed iFinder, an LLM-driven multi-agent system. The system operates through a four-stage pipeline:

A. Preprocessing

• Pattern Distillation: The system analyzes known vulnerabilities from GitHub issues to distill detection patterns. These patterns are expressed as language-agnostic and protocol-agnostic triples: <element, dangerous operation, missing validation>.
• Specification Extraction: It extracts protocol procedures and message schemas from 3GPP specifications to ground the agents in formal protocol definitions.

B. Discovery Agent (DA)

• Backward Analysis: Instead of scanning the entire codebase (which exceeds context limits and induces hallucinations), the DA performs LLM-based backward analysis. It locates "dangerous operations" (e.g., memory dereferences based on message fields) and traces the execution path backward to the message handler.
• Validation Check: It verifies if the required validation (syntactic, semantic, or resource) exists prior to the dangerous operation. If missing, it flags an iTrue candidate.

C. Vetting Agent (VA)

• Code-Specification Cross-Checking: To reduce false positives caused by the DA missing checks performed in earlier protocol states, the VA maps the candidate to the specific 3GPP procedure.
• Context Expansion: It identifies prerequisite messages in the specification, locates their corresponding code handlers, and re-evaluates whether the validation exists in the full procedure context, not just the local snippet.

D. Exploitation Agent (EA)

• PoC Generation & Refinement: The EA generates a Proof-of-Concept (PoC) exploit based on the candidate.
• Feedback-Aware Loop: It executes the PoC in a containerized testbed. If the exploit fails, the agent analyzes runtime logs to diagnose the failure (e.g., missing state dependencies) and iteratively refines the PoC. This loop continues until the vulnerability is triggered or the testing budget is exhausted.

3. Key Contributions

1. Systematic Root-Cause Analysis: The first study to systematically analyze vulnerabilities in open-source CN implementations, identifying implicit trust errors (iTrue) as a pervasive, recurring pattern rather than isolated bugs.
2. iFinder Framework: The development of the first multi-agent system for automated vulnerability discovery in carrier core networks. It introduces novel techniques to handle stateful protocols:
   • Code-Specification Cross-Checking: Grounding analysis in 3GPP procedures to recover full execution context and reduce false positives.
   • Feedback-Aware Refinement: Using runtime execution feedback to iteratively correct LLM-generated exploits, ensuring they are triggerable.
3. Large-Scale Discovery: The implementation and evaluation of iFinder across seven prominent open-source CN implementations (Open5GS, free5GC, OAI, SD-Core, eUPF) covering both 4G and 5G systems.

4. Results

Running iFinder on the target implementations yielded the following results:

• Vulnerabilities Discovered: 84 previously unknown vulnerabilities were found in the PFCP and GTP-C protocols.
• Validation: 83 findings were confirmed by developers, and 81 were assigned CVEs.
• Real-World Impact:
  • A session-hijacking flaw was confirmed on two real-world commercial 5G core networks. This flaw allows an attacker to inject a PFCP Session Modification Request with a duplicate PDR ID and higher priority, causing the User Plane Function (UPF) to redirect victim uplink traffic to the attacker. One vendor has patched this (CVE-2026-8233); the other is in remediation.
  • A DoS vulnerability affecting a commercial 5G core network was also confirmed (CVE-2026-8232).
• Performance Metrics:
  • Compared to a prompt-only baseline, iFinder improved the F1 score from 31.8% to 71.4%.
  • The Vetting Agent reduced false positives from 62 to 19 (Precision increased from 36.7% to 65.5%).
  • The Exploitation Agent successfully generated valid PoCs for 19 out of 22 ground-truth vulnerabilities, compared to only 8 for the baseline.

5. Significance and Claims

The paper claims that iTrue vulnerabilities represent a systemic weakness in carrier core networks, rooted in legacy assumptions that internal interfaces are walled off from untrusted environments. As CNs move to the cloud, these assumptions are invalidated, exposing critical infrastructure to severe risks.

The authors emphasize that:

• Pervasiveness: The flaws are not isolated to specific implementations or languages (found in C, C++, and Go) but are recurring across protocols (GTP-C and PFCP) and generations (4G and 5G).
• Severity: These errors enable attacks beyond simple crashes, including session hijacking, which compromises user privacy and data integrity.
• Need for Defense-in-Depth: The findings highlight an urgent need for elevated protection within original trust domains, including strict validation at internal interfaces, mutual authentication, and zero-trust deployment practices.

The authors plan to make iFinder publicly available to assist in enhancing the security of cellular core networks, while adhering to responsible disclosure practices by withholding unpatched exploit code.