When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter
An LLM-guided analysis pipeline found 95 new vulnerabilities in telecom core-network Diameter signaling, plus 118 more across 16…
Researchers built LENS, a system that guides LLMs through the discipline and evidence-gathering practices of human security experts to analyze exploitability of the Diameter signaling protocol used in cellular core networks. The system found that over 25% of field paths in the S6a and Cx interfaces are exploitable, uncovering 95 previously unknown vulnerabilities in EPC/IMS implementations (17 open-source, 78 commercial), and a further 118 vulnerabilities when applied to 16 other protocols across cellular, network, industrial and host-internal systems.
Why it matters
This demonstrates LLMs can be systematically guided to replicate expert vulnerability-analysis discipline at scale, finding real, previously unknown flaws in widely deployed telecom infrastructure (not just toy benchmarks) and generalizing to protocols well beyond its original target. It signals a meaningful new offensive/defensive security research capability: LLM-driven protocol exploitability analysis that scales across many implementations and protocol families.
What is verified
LENS, an LLM-based system for field-level Diameter protocol exploitability analysis, achieved mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00% across four LLMs and repeated runs. [1]
The researchers found that more than 25% of field paths in the S6a and Cx Diameter interfaces are exploitable under the threat model considered. [1]
Applying LENS uncovered 95 previously unknown vulnerabilities in Diameter-related systems, including 17 in open-source EPC/IMS implementations and 78 in commercial deployments, causing service disruption, information leakage, subscriber tracking, and accelerated battery depletion. [1]
Applying LENS to 16 additional protocols spanning cellular, network, industrial, and host-internal systems uncovered 118 further previously unknown vulnerabilities. [1]
What is not
- No independent verification of the vulnerability counts or disclosure status to affected vendors is given in the evidence.
- The evidence does not specify which commercial vendors or open-source projects were affected, limiting assessment of real-world exposure.
- No information on whether findings were responsibly disclosed or patched before publication.
- The paper is a preprint; it has not been through peer review as described in the evidence.
Sources
- 1arXiv cs.LGarxiv.org · Primary source
Original source published 16 October 2026 at 07:12.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.