CVE-2026-33906

Katalog CVE

CVSS 7.2 · High EPSS 0,56%

Kerentanan Improper Privilege Management pada ellanetworks ella core. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents. A NetworkManager could replace the production database with a tampered copy to escalate to Admin, gaining access to user management, audit logs, debug endpoints, and operator identity configuration that the role was explicitly denied. In version 1.7.0, backup and restore permissions have been removed from the NetworkManager role.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ellanetworks/core/security/advisories/GHSA-87j9-m7x6-hvw2 advisory vendor
• https://github.com/ellanetworks/core/commit/1e4768288a6519fcb63ec83f851584ecebb8a972 patch
• https://github.com/ellanetworks/core/releases/tag/v1.7.0 release notes