Ella Core, a 5G core for private networks, had an improper privilege management vulnerability (CWE-269) where the NetworkManager role was allowed to perform backup and restore operations. The restore endpoint accepted any valid SQLite file without verifying its contents, enabling privilege escalation to Admin by replacing the production database with a manipulated copy. This escalation grants access to administrative capabilities that the NetworkManager role should not have. The vulnerability affects versions prior to 1.7.0. In version 1.7.0, the backup and restore permissions were removed from the NetworkManager role to mitigate this issue.

An attacker with NetworkManager privileges can escalate to Admin by exploiting the restore functionality to replace the production database with a tampered SQLite file. This leads to unauthorized access to user management, audit logs, debug endpoints, and operator identity configuration, compromising confidentiality, integrity, and availability of the system.

Upgrade to ellanetworks core version 1.7.0 or later, where the backup and restore permissions have been removed from the NetworkManager role, eliminating the privilege escalation vector. Patch status is not explicitly confirmed by a vendor advisory, but the version update indicates an official fix. Users should apply this version to remediate the vulnerability.