CVE-2026-34762

Katalog CVE

CVSS 2.7 · Low EPSS 0,31%

Kerentanan Improper Input Validation pada ellanetworks ella core. Skor CVSS 3.1 2.7 (Low) menurut github.com.

Deskripsi (NVD)

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f advisory vendor
• https://github.com/ellanetworks/core/releases/tag/v1.8.0 release notes