As reported by The Hacker News, researchers from Nanyang Technological University (NTU) Singapore have disclosed a sweeping set of 84 security vulnerabilities affecting 4G and 5G core network implementations — a finding that should send a clear signal to mobile network operators, enterprise security teams, and critical infrastructure stakeholders worldwide.

Security Impact: This isn't a single misconfiguration or a one-off implementation bug — it represents a widespread vulnerability class baked into the foundational protocols and software stacks underpinning modern cellular infrastructure.

Why This Matters More Than a Typical CVE Drop

The sheer volume and systemic nature of these findings sets this disclosure apart. This isn't a single misconfiguration or a one-off implementation bug — it represents a widespread vulnerability class baked into the foundational protocols and software stacks underpinning modern cellular infrastructure. When researchers describe something as a "widespread class" of vulnerabilities, defenders should interpret that as: the conditions enabling these bugs are structural, not incidental.

The implications are significant at multiple layers:

Why This Matters More Than a Typical CVE Drop
Session hijacking at the core network level means an attacker who achieves exploitation doesn't just intercept data — they assume the authenticated identity of a legitimate subscriber or device session. This has cascading consequences for everything riding on that session.
Denial-of-service attacks against 5G core components (such as the AMF, SMF, or UPF in 5G standalone architectures) can disrupt connectivity for thousands to millions of users simultaneously — and in critical deployments, that means hospitals, utilities, emergency services, and industrial control systems.
5G core networks increasingly underpin private enterprise deployments, IoT ecosystems, and sovereign critical infrastructure — not just consumer mobile connectivity. The attack surface is far broader than legacy 4G.

Who Is Most Exposed?

While individual subscribers face real risk from session hijacking, the highest-risk targets are institutional:

  • Mobile Network Operators (MNOs) running both 4G EPC and 5G standalone or non-standalone core infrastructure
  • Enterprises deploying private 5G networks for manufacturing, logistics, healthcare, or defense applications
  • Critical national infrastructure where cellular connectivity is a primary or backup communications layer
  • IoT and connected device ecosystems relying on SIM-based authentication over carrier networks
  • Government and defense agencies leveraging commercial cellular for operational communications

The Attacker's Perspective

Exploiting core network vulnerabilities historically required insider access or proximity to carrier infrastructure. However, the democratization of software-defined radio (SDR) tools, the growing availability of open-source 4G/5G core implementations for research, and the increasing exposure of network function APIs (particularly in service-based architecture deployments) lowers the barrier meaningfully for sophisticated threat actors. Nation-state groups and well-resourced criminal organizations that have already demonstrated interest in telecom infrastructure — as seen in campaigns like Salt Typhoon — will take note of this research.

The move to software-defined, cloud-native 5G cores was supposed to improve security through modernization. Research like this is a necessary reminder that software-native doesn't mean security-native.

The Broader 5G Security Maturity Problem

Academic research consistently outpaces operational security in the telecom sector. Standards bodies like 3GPP have improved security specifications with each generation, but implementation quality varies enormously between vendors and operators. The gap between a well-specified standard and a securely implemented, hardened deployment is where vulnerabilities like these live. Operators that have rushed 5G deployment to meet commercial timelines may have inherited security debt they're only now beginning to audit.

Additionally, the interoperability requirements of 4G/5G networks mean that legacy protocol handling — often the least-hardened code path — must remain active, preserving attack surface that operators may assume is low-risk.

Shield53 Recommendations

For Mobile Network Operators and Private 5G Operators

  • Engage your core network vendors immediately to determine which specific products and versions are affected by the NTU findings and request patch timelines in writing.
  • Audit inter-network function authentication within your 5G Service Based Architecture (SBA). Ensure mutual TLS and OAuth 2.0 token validation are enforced — not just configured — between all NFs.
  • Implement anomaly detection on core network interfaces (N1, N2, N4, N6, and HTTP/2-based SBI) to flag unusual session establishment patterns or unexpected AMF/SMF interactions.
  • Segment and restrict access to core network management planes. No core network function should be reachable from untrusted networks without explicit, audited justification.
  • Conduct tabletop exercises simulating session hijacking and core DoS scenarios to validate your detection and incident response capabilities before attackers do it for you.

For Enterprise Security Teams on Private 5G

  • Treat your private 5G core with the same security posture as any other Tier-1 critical infrastructure component — not as a vendor-managed black box.
  • Require your private 5G vendor to provide a software bill of materials (SBOM) and vulnerability disclosure commitments for core network software.
  • Ensure out-of-band connectivity options exist for critical operations that cannot tolerate 5G disruption.

For CISOs and Risk Leaders

  • Include 5G core security in your third-party and supply chain risk assessments if your organization depends on carrier or private 5G connectivity.
  • Monitor GSMA and 3GPP security working group outputs for guidance as vendor patches and mitigations are developed in response to this research.