Identifying and Exploiting a Denial-Of-Service Vulnerability in the NGAP Protocol in 5G Networks

With the rapid evolution of communication technologies, 5G networks promise to deliver a wide range of services and higher speeds. However, as these networks integrate into critical infrastructure, ensuring their security against malicious attacks is paramount. This paper focuses on a specific security vulnerability within the Next Generation Application Protocol (NGAP), which facilitates communication between NextGeneration Node B (gNB) and Access and Mobility Management Function (AMF) in the 5G Core Network (5 GCN). Through an experimental study that draws on an open source testbed based on the latest Third Generation Partnership Project (3GPP) specifications, we identify and validate a Denial-of-Service (DoS) attack. The attack exploits the absence of mandatory security measures, such as IPSec, allowing a fake gNB to impersonate a legitimated one and inject malicious NGAP messages, causing unintended user disconnections. Although the study is conducted on an open source implementation, we discuss its broader implications, emphasizing how similar vulnerabilities could raise in commercial deployments due to operator-specific configurations and optional security controls in 3GPP standards. Mitigation strategies are proposed to address these risks, including enforcing mandatory security controls and improving gNB authentication mechanisms. This work highlights the need for stricter enforcement of security measures to safeguard the reliability of 5G networks.