LENS finds 95 new Diameter flaws in cores and commercial gear
Original title: When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter
Over 25% of S6a and Cx field paths were exploitable; 118 more flaws appeared in 16 other protocols.
Researchers present LENS, an LLM system that applies expert analysis discipline and protocol evidence to judge Diameter field exploitability and generate proof-of-concept attacks when applicable. Across four LLMs, mean recall was 94.00% to 98.00%, precision 78.73% to 88.94%, and accuracy 84.00% to 92.00%. They report more than 25% of S6a and Cx field paths exploitable under their threat model, and 95 previously unknown vulnerabilities: 17 in open-source EPC/IMS implementations and 78 in commercial deployments. Effects include service disruption, information leakage, subscriber tracking, and accelerated battery depletion. The same method found 118 further previously unknown flaws in 16 additional protocols.
Unconfirmed: The 95 and 118 vulnerabilities are author-reported; vendor confirmation and CVE assignment are not stated.
- Mean precision across four LLMs and repeated runs was 78.73% to 88.94%.
- Seventeen flaws were in open-source EPC/IMS code and 78 in commercial deployments.
- Reported effects include disruption, leakage, subscriber tracking, and battery drain.
- LENS also reported 118 new flaws across 16 other protocols.
Impact: disruption, leakage, subscriber tracking, and battery drain
| Product | Affected |
|---|---|
| Diameter S6a and Cx interfaces | — |
| open-source EPC/IMS implementations | — |
| commercial cellular deployments | — |
From the original article
1 min read at arxiv.orgThe increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface.
By Wei Yi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.