PaperlayerView exact revision on arXiv

Source-linked AI summary

When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter

Wei Yi, Changlong Han, Xue Zhang, Qiao Zhang, Yi Chen, Jin Cao, Di Tang, Yulong Fu, Ben Niu, Hui Li

arXiv:2610.22943v2cs.CR

TL;DR

Public exposure of cellular core-network elements makes Diameter a practical attack surface, while isolated attack cases leave broader risks uncharted. LENS infers analysis discipline and evidence-collection guidance to assess fields and generate PoCs when applicable. Its analysis finds exploitable S6a and Cx fields and previously unknown vulnerabilities in implementations.

  • Problem

    Publicly reachable core-network elements make Diameter a practical attack surface, but prior work provides isolated attack cases rather than a systematic account of broader signaling-interface risks.

    Source: §1 · p. 1

  • Method

    LENS infers exploitability-analysis discipline from existing exploit writeups and evidence-collection guidance from incorrect-versus-ground-truth writeup differences, then uses both to analyze target fields and generate PoCs when applicable.

    Source: §1 · p. 2

  • Results

    Among 766 S6a and Cx fields, 204 (26.63%) were exploitable, and implementation assessment uncovered 95 previously unknown vulnerabilities.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The implementation vulnerabilities include persistent service disruption, information leakage, subscriber tracking, and accelerated battery depletion affecting real subscribers.

    Source: §1 · p. 2

    The manually labeled evaluation dataset contains 40 protocol fields; a larger ground-truth dataset would further strengthen the evaluation.

    Source: §7 · p. 13

Abstract

from arXiv · show

The increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface. While large language models (LLMs) show promise for protocol exploitability analysis, we find that their judgments on Diameter can be unreliable because they may deviate from the tacit analysis discipline followed by security experts and reach conclusions without considering complete protocol evidence. To address this challenge, we present LENS, an LLM-based system for reliable field-level Diameter exploitability analysis. LENS guides LLMs using both exploitability-analysis discipline and the protocol evidence needed for analysis. It infers analysis discipline from existing exploit writeups and evidence-collection guidance from exploitability-analysis failures, enabling systematic evidence collection, exploitability assessment, and proof-of-concept (PoC) attack generation when applicable. Our experiments show that LENS performs reliable analysis across four LLMs and repeated runs, achieving mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00%. We find that more than 25% of field paths in the S6a and Cx interfaces are exploitable under the considered threat model. We further assess their impact on practical implementations and uncover 95 previously unknown vulnerabilities, including 17 in open-source EPC/IMS implementations and 78 in commercial deployments, causing service disruption, information leakage, subscriber tracking, and accelerated battery depletion. Applying LENS to 16 additional protocols spanning cellular, network, industrial, and host-internal systems uncovers 118 previously unknown vulnerabilities, demonstrating its strong generalizability.

1. Introduction

Publicly reachable core-network elements make Diameter a practical attack surface, but isolated attack cases do not reveal the broader risks. LENS addresses unreliable LLM judgments by guiding evidence collection and exploitability analysis; its assessment finds widespread exploitable fields and previously unknown implementation vulnerabilities.

1. Introduction

  • Public reachability of core-network elements is a practical reality, while prior work has shown isolated attacks rather than systematically mapping the broader signaling-interface risks.Source: §1 · p. 1
  • Diameter fields can affect later security-sensitive operations across procedures and network elements, making manual analysis of hundreds of fields impractical.Understanding those effects may require correlating logic across complex 3GPP specifications; expert discipline is difficult to articulate, and relevant evidence is often found iteratively after failed exploit attempts.Source: §1 · pp. 1–2
  • Direct LLM judgments can succeed and produce working PoCs, but preliminary experiments found failures in more than half of cases.The failures mainly involved drifting from expert analysis discipline or judging without considering all relevant protocol evidence.Source: §1 · pp. 1–2
  • LENS infers exploitability-analysis discipline from existing exploit writeups and general evidence-collection guidance by examining differences between incorrect and ground-truth writeups.The guidance is intended to apply to any target field rather than identify only the missing evidence for one case.Source: §1 · p. 2
  • For each target field, LENS collects protocol evidence, guides LLM exploitability analysis with that evidence and inferred discipline, and generates PoCs when a field is deemed exploitable.The PoCs are also used to assess security impacts in representative core-network implementations in a controlled testing environment.Source: §1 · p. 2
  • Among 766 S6a and Cx fields, 204 (26.63%) were exploitable, and implementation assessment uncovered 95 previously unknown vulnerabilities.LENS achieved mean recall of 94.00% to 98.00%, mean precision of 78.73% to 88.94%, and mean accuracy of 84.00% to 92.00% across four LLMs and repeated runs.Source: §1 · p. 2
  • Applying LENS to 16 additional protocols uncovered 279 protocol-level PoC candidates, including 150 previously unreported candidates, with 118 confirmed in real open-source implementations.Source: §1 · p. 2

2. Background

Diameter signaling supports communication among 4G core-network elements, with S6a and Cx serving distinct subscriber-management and IMS functions. The analysis assumes publicly reachable interfaces without incoming TLS protection and an attacker able to impersonate a legitimate network element and send crafted messages.

2. Background

  • Diameter is a signaling protocol family used for communication among 4G core-network elements, whose messages request information, deliver instructions, or drive control-plane decisions.Source: §2 · p. 3
  • S6a connects the MME and HSS for subscriber management and authentication, while Cx connects IMS entities and the HSS for IMS service control.Source: §2 · p. 3
  • The threat model assumes a publicly reachable Diameter interface without incoming TLS protection, allowing an attacker impersonating a legitimate network element to send crafted messages.Manipulated field values may influence subsequent network operations; the paper states that this setting occurs in real deployments.Source: §2 · p. 3

3. Design

LENS equips LLMs with expert-like exploitability-analysis discipline and protocol evidence, inferring and jointly refining prompts that guide field analysis, PoC generation, and implementation impact assessment.

3.1. Overview

  • LENS collects protocol evidence with pevi, then uses that evidence and the target field with pexp to assess exploitability and generate a PoC when applicable.Generated PoCs are executed against representative implementations in controlled testing to assess whether predicted security impacts occur.Source: §3.1 · p. 3

3.2. Exploitability-Analysis Discipline Inference

  • Expert-written exploit analyses provide examples from which an LLM infers pexp, a prompt encoding the exploitability-analysis discipline for new Diameter fields.The examples pair target fields and supporting evidence with expert writeups; LENS seeds inference with one exploitable and one non-exploitable example.Source: §3.2 · pp. 3–4

3.3. Evidence-Collection Guidance Inference

  • LENS infers pevi from failed analyses, using analysis history, expert-written ground truth, and failure feedback to derive general evidence-collection guidance.The resulting prompt guides evidence collection for later exploitability analysis rather than identifying only evidence for the current failed field.Source: §3.3 · pp. 4–5

3.4. Iterative Co-Inference of the Two Prompts

  • Because pexp inference benefits from pevi evidence and pevi inference relies on failures under pexp, LENS alternates between refining the two prompts.Refinement repeats until generated writeups match expert conclusions and analyses, and applicable PoCs achieve their described effects; it typically takes one to two rounds.Source: §3.4 · p. 5

3.5. Security Impact Assessment

  • LENS tests generated PoCs in an isolated environment, instantiating deployment-specific identities and checking observed subscriber state and network responses against predicted impacts.Assessment includes service behavior and whether returned Diameter messages contain the sensitive information predicted by the analysis.Source: §3.5 · pp. 5–6

4. Evaluation

LENS's inferred prompts are general and encode evidence-collection guidance and expert-like analysis discipline. Across four LLMs it achieves high recall, precision, and accuracy, while controlled studies examine its design choices and configuration.

4.1. Understanding the Inferred Guidance and Discipline

  • The inferred prompts generalize beyond their inference examples, and pevi covers field semantics, roles, state changes, authority, downstream effects, and PoC evidence needs.pexp requires consideration of message direction, AVP semantics, receiver processing, state and authority, downstream consequences, and PoC feasibility before reaching a conclusion.Source: §4.1 · pp. 6–7

4.2. End-to-End Effectiveness

  • 94.00% to 98.00% mean recall, 78.73% to 88.94% mean precision, and 84.00% to 92.00% mean accuracy across four LLMs show LENS's end-to-end effectiveness.Metrics are means across five runs; Table 5 reports the results.Source: Table 5 · p. 7, §4.2 · p. 7
  • GPT correctly analyzes 37/40 fields in at least four of five runs, while Claude and Gemini each analyze 35/40 and GLM analyzes 31/40.Across 800 analyses, LENS makes 88 misclassifications across 16 fields: 72 false positives and 16 false negatives.Source: §4.2 · p. 7

4.3. Understanding LENS Effectiveness

  • Adding exploitability-analysis discipline raises accuracy from 40.00% to 65.00%, and adding protocol evidence raises it from 65.00% to 82.50%.Discipline primarily improves precision, while protocol evidence primarily improves recall; the authors conclude both are needed for reliable analysis.Source: Table 7 · p. 8, §4.3 · p. 8
  • Inferred discipline improves precision to 100.00% and accuracy to 72.50%, versus 77.78% precision and 62.50% accuracy for the few-shot baseline.Evidence from inferred pevi yields 80.00% recall and 82.50% accuracy, compared with retrieval-baseline ranges of 40.00%–55.00% recall and 67.50%–70.00% accuracy.Source: Table 8 · p. 8, §4.3 · pp. 8–9
  • Prompt refinement raises recall from 80.00% to 100.00%, precision from 84.21% to 90.91%, and accuracy from 82.50% to 95.00%.The comparison is between initial pexp plus initial pevi and the final refined prompts.Source: §4.3 · p. 9

4.4. Configuration Study

  • Using more than one exploitable and one non-exploitable inference example shows no clear performance benefit, while adding expert writeups and analysis history improves pevi inference results.Across configurations, adding the expert writeup raises recall from 55.0% to 70.0% and accuracy from 72.5% to 80.0%; adding history raises recall to 80.0% and accuracy to 82.5%.Source: §4.4 · p. 9

5. Findings

LENS identifies validated field-level Diameter exploitability across S6a and Cx, then tests predicted impacts in practical implementations and demonstrates representative attacks on subscribers.

5.1. Protocol-Level Findings

  • 26.63% of 766 analyzed S6a and Cx fields are validated as exploitable under the threat model, and 196 of the 204 findings were previously unreported.LENS initially flagged 223 fields; manual audit confirmed 204.Source: §5.1 · p. 10
  • Of 222 generated PoCs, 85 (38.29%) predict service disruption and 76 (34.23%) service degradation, while others expose information, deplete batteries, or enable subscriber tracking.The two availability categories comprise 72.52% of PoCs; other reported consequences include 32 information-leakage PoCs, 15 battery-depletion PoCs, and 14 tracking or online-status PoCs.Source: §5.1 · p. 10

5.2. Implementation-Level Findings

  • Among 56 protocol-level exploitable fields supported by evaluated implementations, 51 (91.07%) are confirmed exploitable, and 64 of 71 PoCs (90.14%) trigger predicted impacts.The assessed environments include Open5GS, Kamailio, and two anonymized commercial implementations.Source: §5.2 · pp. 10–11
  • Open5GS's fresh subscriber-data retrieval can overwrite manipulated state, while Kamailio supports some fields without implementing behaviors needed for the predicted impact.The Open5GS behavior is not required by the 3GPP specifications; commercial source code was unavailable for this failure analysis.Source: §5.2 · p. 11
  • The study reports 95 previously unknown implementation-confirmed vulnerabilities: 17 in open-source and 78 in commercial implementations.Both commercial vendors confirmed all reported vulnerabilities; 5 CVEs and 7 CNVD identifiers had been assigned to reported Open5GS vulnerabilities at writing.Source: §5.2 · p. 11

5.3. Representative Attacks

  • A rogue EPS/IMS network attack combines leaked authentication vectors and subscriber profiles with forced detachment to take over a victim's cellular connectivity.The attack uses stolen EPS-AKA and IMS-AKA vectors to complete attachment and registration, then provides services indistinguishable from the legitimate network.Source: §5.3 · pp. 11–12
  • Manipulated APN settings can cause persistent LTE service loss, while a shortened TAU timer can accelerate battery depletion by forcing frequent network procedures.In the testbed, a 2-second timer depleted one device advertised for three years of battery life in 83 hours and another advertised for one month in 13 hours.Source: §5.3 · p. 12

6. Generalizability Beyond Diameter

LENS is applied unchanged to 16 additional protocols, where it identifies previously unreported vulnerabilities confirmed in representative open-source implementations.

6. Generalizability Beyond Diameter

  • LENS's protocol-specific guidance inference is applied without modifying the methodology across 16 additional protocols spanning diverse domains.For each target protocol, prompt inference uses one exploitable and one non-exploitable example.Source: §6 · p. 12
  • Across 857 fields, LENS generates 279 protocol-level PoCs, including 150 previously unreported findings that are evaluated on representative open-source implementations.The evaluated protocols include VoIP communication, Internet routing, and IoT messaging.Source: §6 · p. 12
  • 118 previously unreported vulnerabilities successfully trigger predicted impacts, supporting LENS's transferability across the evaluated protocols.Reported attacks include unauthorized message injection, session hijacking, response manipulation, denial of service, and information leakage.Source: §6 · p. 12

7. Discussion

A strengthened Diameter fuzzing baseline reproduced the field-value manipulations in LENS’s 64 PoCs but detected the security effects of only 26. The discussion also highlights persistent deployment risks and a 40-field evaluation dataset.

LENS and protocol fuzzing

  • The baseline used the same field-value manipulations as all 64 PoCs, but detecting the remaining attacks required reasoning about downstream behavior.The authors suggest a stateful fuzzer could identify them if the necessary actions and checks were known and encoded in advance.Source: §7 · pp. 12–13
  • The fuzzing baseline detected security effects for 26 of 64 LENS PoCs (40.63%), while 38 required additional test logic.For 29, effects appeared only after a specific subsequent action; 9 required custom detection procedures.Source: §7 · p. 13

From case-based discovery to systematic discovery

  • LENS’s reusable guidance, inferred from expert-discovered cases, suggests security-analysis knowledge can be captured and propagated beyond case-by-case discovery.The authors frame a shift toward more systematic discovery as a possibility.Source: §7 · p. 13

The challenge of practical mitigation

  • Publicly reachable core-network elements and disabled TLS are expected to persist in operational environments because of deployment, maintenance, interoperability, and performance considerations.The authors describe the resulting security risk as a persistent operational challenge for core networks.Source: §7 · p. 13

Limitation

  • The manually labeled evaluation covers 40 protocol fields because expert analysis and, often, PoC construction make ground-truth labeling expensive and time-consuming.The dataset covers exploitable and non-exploitable fields across S6a and Cx; the authors say a larger ground-truth dataset would strengthen evaluation.Source: §7 · p. 13

8. Related Work

Prior cellular-security work emphasizes testing, formal verification, and fuzzing, while LENS addresses whether protocol-compliant functionality can be exploited to cause security consequences. Unlike many LLM-assisted systems that use explicit task information, LENS must obtain tacit analysis discipline and evidence-collection guidance.

Security analysis of cellular networks

  • Prior cellular-security techniques test expected behavior, verify predefined properties, or fuzz messages and states; LENS instead assesses whether protocol-compliant functionality can cause security consequences.The related work groups prior approaches into testing-based analysis, formal verification, and fuzzing.Source: §8 · p. 13

LLM-assisted security analysis

  • Unlike LLM-assisted systems that use explicit inputs such as code, grammars, traces, or tool outputs, LENS must obtain tacit exploitability-analysis discipline and evidence-collection guidance.The authors identify obtaining this expert knowledge as part of the problem LENS addresses.Source: §8 · p. 13

9. Conclusion

LENS supports reliable field-level protocol exploitability analysis; its Diameter S6a and Cx analysis found more than one quarter of analyzed fields exploitable and uncovered vulnerabilities in existing implementations.

9. Conclusion

  • LENS is presented as an LLM-based methodology for reliable field-level protocol exploitability analysis.Source: §9 · p. 13
  • More than one quarter of analyzed Diameter S6a and Cx fields were exploitable, and the analysis uncovered 95 previously unknown vulnerabilities in existing implementations.The conclusion reports these vulnerabilities in open-source and commercial EPC/IMS implementations.Source: §9 · p. 14

Appendix A. Open Science

  • The authors publicly release the source code, prompts, evaluation data, and protocol-level PoCs.Source: Appendix A · p. 15

Appendix C. Additional Results

Appendix C presents tables on LENS's end-to-end effectiveness and per-field correctness across five runs, with a note explaining how the run counts are read.

Appendix C. Additional Results

  • Table 14 presents LENS's end-to-end effectiveness.Source: Table 14 · p. 15
  • Table 15 presents per-field correctness across five runs.Source: Table 15 · p. 15
  • Each column counts fields correctly analyzed in exactly k of five runs; 5/5 means correct in all five runs.Source: Appendix C · p. 15

Appendix D. Ethics Considerations

The ethics discussion describes controlled testing and responsible disclosure, while the accompanying meta-review summary outlines LENS's approach and evaluation scope.

Appendix D. Ethics Considerations

  • Tests used isolated environments: local Open5GS and Kamailio testbeds were separated from production networks, and commercial systems from real deployments.Source: Appendix D · p. 16
  • For non-Diameter protocols, generated PoCs were evaluated only in local open-source test environments, with inputs and failures confined to local or virtual machines.Source: Appendix D · p. 16
  • The authors report a subset of confirmed vulnerabilities and plan phased disclosure of the remainder, with no PoCs released for unfixed vulnerabilities.They state the remaining reports would be completed no later than the rebuttal deadline.Source: Appendix D · p. 16
  • LENS could be misused to test systems without permission or disrupt vulnerable deployments; the authors recommend controlled use and timely reporting.Source: Appendix D · p. 16

Appendix E. Meta-Review

  • The meta-review was prepared by the program committee for the 2027 IEEE Symposium on Security and Privacy.Source: Appendix E · p. 16

E.1. Summary

  • The meta-review summary describes LENS as deriving an analysis procedure from expert examples, collecting protocol evidence, and assessing fields and constructing PoCs.Its evaluation covered Open5GS, Kamailio, and two commercial implementations.Source: §E.1 · p. 16

E.2. Scientific Contributions •

The meta-review identifies LENS as a scientific contribution and highlights its ability to surface semantic security effects, supported by audited findings and working PoCs.

E.2. Scientific Contributions •

  • The scientific-contributions section characterizes LENS as a new tool, an impactful vulnerability identification, and a step forward in an established field.Source: §E.2 · p. 16

E.3. Reasons for Acceptance

  • LENS provides a practical way to identify semantic security effects that conventional fuzzing oracles can miss, with concrete findings and working PoCs across open-source and commercial implementations.Source: §E.3 · p. 16
  • The authors tested four LLMs in five runs each and manually audited all 223 fields initially reported by LENS, removing 19 unsupported results.Source: §E.3 · p. 16
  • The audit confirmed 51 fields in at least one implementation and validated 153 at the protocol level; grouping them into 49 message-level scenarios clarifies the results' scope.Source: §E.3 · p. 16

E.4. Noteworthy Concerns

The authors identify limitations in the threat model, reliability benchmark, and DiaFuzzer comparison. The accompanying tables organize field-level results by message scenario and summarize implementation impacts and additional evaluations.

E.4. Noteworthy Concerns

  • The threat model requires an accepted Diameter peer, while deployment assumptions and peer capabilities versus implementation vulnerabilities are not clearly distinguished.Source: §E.4 · p. 16
  • The reliability benchmark has only 40 author-labeled fields, limiting reliability and cross-protocol generalization.Source: §E.4 · p. 16
  • DiaFuzzer receives the same mutations as LENS, so the comparison tests effect detection rather than end-to-end vulnerability discovery.Source: §E.4 · p. 16
  • The 204 validated fields are grouped into 49 message-level scenarios by Diameter message, receiver, and receiver-side operation.Table 16 reports field and PoC counts for those scenarios.Source: §E.4 · p. 17, Table 16 · p. 17
  • Table 17 categorizes implementation impacts as service disruption, service degradation, information leakage, battery depletion, and subscriber tracking.Tables 18 and 19 report generalizability results across non-Diameter protocols and a DiaFuzzer-based comparison, respectively.Source: Table 17 · pp. 18–19, Table 18 · p. 19, Table 19 · p. 19
Loading 2610.22943v2…