CVE-2026-33907CWE-476

Ella Core Panics during NAS Authentication Response/Failure with missing IEs

Medium · published March 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS message missing IEs. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.7.0 added IE presence verification to NAS message handling.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-03-27T20:58Z
EPSS history
Timeline
  • 27 MAR 20:58Z
    Ella Core Panics during NAS Authentication Response/Failure with missing IEs
    cvelistv5