Ella Core, a 5G core product by ellanetworks designed for private networks, suffers from a NULL pointer dereference vulnerability (CWE-476) in versions before 1.7.0. This occurs when the core processes Authentication Response and Authentication Failure NAS messages missing required Information Elements, causing a panic and process crash. The vulnerability can be exploited without authentication by sending crafted NAS messages, leading to denial of service for all connected subscribers. The issue is addressed in version 1.7.0 by implementing IE presence verification in NAS message processing.

Exploitation of this vulnerability results in a denial of service condition by crashing the Ella Core process, disrupting service for all subscribers connected to the affected core. There is no confidentiality or integrity impact reported. No authentication is required to exploit this vulnerability, increasing the risk of remote disruption.

Upgrade to ellanetworks Ella Core version 1.7.0 or later, which includes a fix by adding Information Element presence verification in NAS message handling. Since no official patch links are provided, verify the upgrade availability and instructions with the vendor. Patch status is not yet confirmed via vendor advisory; check ellanetworks' official resources for the latest remediation guidance.