Open5GS

AI System iFinder Uncovers 84 Zero-Day Vulnerabilities in 4G and 5G Networks, 23 CVEs Still Unpatched

Researchers from Nanyang Technological University deployed the AI-driven system iFinder against software managing 4G and 5G networks, discovering 84 previously unknown vulnerabilities. Developers confirmed 83 of the findings, with 81 receiving CVE identifiers. Only 58 issues have been patched so far, leaving 23 confirmed vulnerabilities with CVE numbers awaiting fixes. The most severe flaw enables session hijacking by injecting a network rule that reuses an existing identifier but carries a higher priority, bypassing uniqueness checks and redirecting subscriber traffic to the attacker. The attack was fully reproduced on OpenAirInterface and validated in two commercial 5G networks, with one vendor releasing a patch for CVE-2026-8233. iFinder operates through three coordinated AI agents that identify unvalidated inputs, cross-reference 3GPP standards, and iteratively develop working exploits, though manual verification remains necessary due to false positives. Open5GS, SD-Core, and free5GC have begun remediation, while three of seven tested projects have issued no patches.