3GPP TR 33.926

An attacker with physical access to network equipment may tamper with hardware, extract sensitive data, or modify the equipment to behave maliciously. Physical attacks include:

• Probing debug interfaces (JTAG, serial console)
• Extracting firmware or keys from flash/storage
• Hardware implants or modifications
• Theft of equipment containing sensitive data
• Environmental manipulation (power glitching, temperature attacks)

All product classes, especially those deployed in physically exposed locations: gNB (outdoor/rooftop), small cells, any equipment at cell sites.

• TS 33.117 — TC_PHYSICAL_TAMPER_EVIDENCE (clause 4.2.3.1)
• TS 33.117 — TC_SECURE_BOOT (clause 4.2.3.2)
• TS 33.512 — gNB-specific physical security tests

An attacker passively captures network traffic to extract sensitive information. Includes:

• Sniffing unencrypted management interfaces
• Capture of cleartext credentials or session tokens
• Interception of GTP-U user data on N3/N9 without IPsec
• Passive monitoring of NAS messages before security activation
• SUPI exposure if null concealment scheme is used

All product classes. Critical for: gNB (radio interface), UPF (user data), AMF (NAS signaling), SEPP (inter-PLMN).

• TS 33.117 — TC_TLS_PROTECTION (clause 4.2.2)
• TS 33.501 — SUCI concealment (clause 6.3)
• TS 33.501 — NAS/AS encryption
• TS 33.210 — IPsec on network interfaces

An attacker positions between two communicating entities to intercept, modify, or inject messages. Includes:

• ARP spoofing on management networks
• BGP hijacking to redirect traffic
• Rogue gNB impersonation
• DNS poisoning to redirect SBI traffic
• TLS stripping / downgrade attacks

§5.3.3.5 IP Spoofing: An attacker spoofs the source IP of GTP packets to inject malicious traffic, impersonate legitimate network elements, or bypass access controls relying on IP addresses.

• TS 33.117 — TC_TLS_PROTECTION with mutual authentication
• TS 33.117 — TC_GTP-C_FILTERING, TC_GTP-U_FILTERING (§4.2.6)
• TS 33.210 — IPsec with IKEv2 mutual auth
• TS 33.501 — NAS integrity protection (prevents rogue gNB NAS attacks)

An attacker disrupts the availability of network services. Attack vectors:

• Volumetric flooding attacks (DDoS) against NFs
• Application-layer attacks against SBI services
• GTP-C storm: flooding the control plane with GTP-C Create Session Requests
• Radio jamming of the air interface
• Resource exhaustion by triggering expensive operations (mass authentication requests)
• NAS signaling storms from compromised UEs

• TS 33.117 — TC_RATE_LIMITING (clause 4.2.3)
• TS 33.117 — TC_FUZZ_TESTING (clause 4.4.3)
• TS 33.117 — TC_GTP-C_FILTERING (clause 4.2.6)
• Product-specific rate limiting and overload control

An attacker gains unauthorized access to NE management interfaces, NF services, or data. Vectors include:

• Default or weak credentials on management interfaces (SSH, NETCONF, web)
• Exploitation of authentication bypass vulnerabilities
• Privilege escalation after initial access
• Unauthorized NF service access due to missing OAuth token validation
• Access to debug/diagnostic interfaces left enabled in production

• TS 33.117 — TC_STRONG_AUTHENTICATION (clause 4.2.3.3)
• TS 33.117 — TC_AUTHORIZATION_TOKEN (clause 4.2.2)
• TS 33.117 — TC_HARDENING_BASELINE (clause 4.3.1)
• TS 33.501 — OAuth 2.0 NF service authorization (clause 13.2)

Sensitive information is exposed to unauthorized parties. This is a broad category with several sub-threats:

Error messages or stack traces expose internal implementation details, software versions, database schemas, or file paths to attackers. Verbose error responses from SBI services can reveal:

• Internal IP addresses and hostnames
• Software/framework versions
• Database table/column names
• Internal API endpoint paths
• Authentication mechanism details

TS 33.117 — TC_ERROR_HANDLING (clause 4.2.3.9): Verify that error messages do not disclose implementation details.

Network equipment runs services or exposes ports not required for its intended function, increasing the attack surface:

• Listening on unneeded TCP/UDP ports
• Running debug web servers, telnet, FTP, SNMP with default communities
• Exposing development/test APIs in production builds
• Unused protocol handlers (e.g., diameter on a 5G-only node)

• TS 33.117 — TC_PORT_SCANNING (clause 4.4.1): Port scan to identify exposed services
• TS 33.117 — TC_HARDENING_BASELINE (clause 4.3.1): Disable unnecessary services

GTP traffic on the user plane (GTP-U) and control plane (GTP-C) is not properly isolated from other network traffic, or filtering is inadequate at network element boundaries. This enables:

• Spoofed GTP-C messages creating/modifying/deleting sessions
• GTP-U packet injection into active user sessions
• Cross-plane traffic leakage (management traffic reaching GTP plane)
• Bypassing security controls by sending GTP from unauthorized sources
• GTP-in-GTP tunneling attacks

UPF (primary — processes all GTP-U), gNB (N3 GTP-U endpoint), SGW/PGW (4G), any element handling GTP.

• Session hijacking: Attacker sends GTP-C Delete Session followed by Create Session with attacker-controlled endpoint
• Data interception: Attacker injects GTP-U packets with matching TEID to capture user data
• Billing fraud: Attacker creates unauthorized GTP sessions for free data
• DoS via GTP storm: Flooding GTP-C Create Session requests to exhaust resources

• TS 33.117 — TC_GTP-C_FILTERING (clause 4.2.6): 10-step GTP-C filter verification
• TS 33.117 — TC_GTP-U_FILTERING (clause 4.2.6): 10-step GTP-U filter verification
• TS 33.513 — UPF-specific GTP filtering requirements
• TS 33.210 — IPsec for GTP interface protection

Network equipment contains exploitable software vulnerabilities in OS, libraries, or application code:

• Unpatched known CVEs in OS or third-party libraries
• Buffer overflows in protocol parsers (GTP, SCTP, Diameter, HTTP/2)
• Injection vulnerabilities (SQL, command, LDAP)
• Deserialization attacks
• Memory corruption in native code

Network services exposed by the NE contain vulnerabilities that can be exploited remotely:

• Services accepting unauthenticated connections
• Protocols without integrity/confidentiality protection
• Legacy protocols (telnet, FTP, SNMPv1/v2c) still active
• HTTP interfaces without TLS
• Management interfaces accessible from untrusted networks

• TS 33.117 — TC_VULNERABILITY_SCANNING (clause 4.4.2)
• TS 33.117 — TC_FUZZ_TESTING (clause 4.4.3)
• TS 33.117 — TC_PORT_SCANNING (clause 4.4.1)
• TS 33.117 — TC_HARDENING_OS (clause 4.3.2)

Authorized personnel (operators, administrators, vendor support) misuse their legitimate access:

• Accessing subscriber data without authorization
• Modifying network configuration maliciously
• Exfiltrating cryptographic keys or credentials
• Installing backdoors or unauthorized software
• Disabling security controls (logging, access controls, encryption)

An authorized user exploits their legitimate access to perform actions beyond their authorized scope. This includes:

• Admin using root access to view subscriber data
• Vendor support extracting security keys during maintenance
• Operator modifying audit logs to hide actions
• Accessing NF service tokens and reusing them cross-NF

• TS 33.117 — TC_AUDIT_LOGGING (clause 4.2.3): Tamper-evident audit logs
• TS 33.117 — TC_RBAC (clause 4.2.3): Role-based access control
• TS 33.117 — TC_SESSION_MANAGEMENT (clause 4.2.3): Session timeout and limits
• TS 33.501 — OAuth scope validation (clause 13.4)

Service-Based Interfaces (HTTP/2 over TLS) introduce web-application-style threats to the 5G core:

• HTTP/2 specific attacks (HPACK bomb, stream multiplexing abuse)
• REST API abuse: parameter tampering, IDOR, mass enumeration
• OAuth token theft or forging
• Cross-NF request smuggling
• TLS configuration weaknesses (weak ciphers, expired certificates)
• Service mesh lateral movement after initial compromise

• TS 33.117 — Section 4.2.2 (SBA/SBI security tests)
• TS 33.501 — Section 13 (full SBA security framework)

All 5G SBI communication uses JSON over HTTP/2. JSON parsers in NFs may be vulnerable to:

• Deeply nested JSON causing stack overflow / DoS
• Extremely long string values causing memory exhaustion
• Duplicate key handling inconsistencies enabling parser confusion
• Unicode escape abuse for WAF bypass
• Integer overflow in numeric parsing
• Null byte injection in string values

• TS 33.117 — TC_FUZZ_TESTING (clause 4.4.3): Protocol-level fuzzing including JSON
• TS 33.117 — TC_INPUT_VALIDATION (clause 4.2.3): Validate all SBI request inputs
• Product-specific SCAS may add JSON-specific fuzz test requirements