| Internet edge and OOB management | Stolen admin identity, exposed management service, vulnerable VPN/router, configuration modification | Shared admin access, Internet-reachable management, weak ACLs, unpatched edge device, unmanaged virtual router/container | PE/CE router, VPN, SSH, SNMP, NETCONF/RESTCONF, AAA | Running/startup config; AAA accounting; command history; VPN auth; config diff; firmware inventory; flow logs | D/A | Partial: Docker host is the management-plane analogue; no carrier router. |
| DNS, registrar, and eDNS | Credential theft, record manipulation, or pivot across trusted carrier DNS | Weak registrar proofing, reusable credentials, poor DNS-change approval, external SSH exposure | Authoritative DNS, registrar/EPP, carrier eDNS | Zone changes; registrar audit; EPP key lifecycle; DNSSEC state; SSH auth; authorized_keys; host binaries; iptables | D | Absent from active lab. Docker service discovery is only a limited analogue. |
| Vendor and supply chain | Signed or trusted software/update carries malicious code; compromised MSP identity pivots inward | Weak artifact provenance, mutable tags, no digest/signature verification, broad vendor access | Desktop agents, package repositories, CI/CD, container registries, MSP remote access | Lockfiles; SBOM; image digest; signature/attestation; build logs; deployment identity; unusual child processes | D/A | Present as a design risk: external Docker base images and local UERANSIM build image. |
| OSS/BSS and CDR stores | Web-shell entry, credential dumping, bulk querying or export | Internet-facing IIS/app flaw, weak service accounts, overbroad DB read, missing query/export detection | IIS, CRM, billing, provisioning, CDR warehouse, TM Forum APIs | Web roots; IIS logs; w3wp.exe children; service-account use; DB audit; export jobs; TMF API gateway logs | D/A | Production layer absent. MongoDB is a subscriber-store analogue, not a CDR warehouse. |
| Subscriber provisioning | Valid admin/API access changes SIM profile, authentication data, APN, or policy | No DB authentication, broad write role, static K/OP material, weak dual control | HSS/UDR/UDM, provisioning portal, MongoDB, eSIM systems | Subscriber change log; DB auth/audit; seed_subscribers.sh; compose DB URI; UE credential config | D/A/L | Strong lab coverage through MongoDB, WebUI, UDR/UDM/HSS, and seeded subscriber. |
| 5G service-based architecture | Rogue NF identity, unauthorized service call, discovery poisoning, malformed request, vulnerable NF | Missing TLS/mTLS and NF authorization; reachable vulnerable implementation; weak schema/state validation | NRF, SCP, AMF, SMF, AUSF, UDM, UDR, PCF, NSSF, BSF over HTTP/2 SBI | NF registration/deregistration; NRF registry snapshot; HTTP status and peer identity; NF logs; config URIs; container restart count | A/L; CVE where named | Strong. All active NFs use cleartext http://...:7777; lab test confirms unauthenticated NF registration. |
| Open5GS NRF | Network-reachable crafted management action causes NRF to delete its own registry and abort | CVE-2025-41067, Open5GS through 2.7.6; unauthenticated reachable assertion per NVD | Open5GS NRF | Image/version; NRF logs and restart count; NF registry discontinuity; nrf.yaml; container events | Confirmed CVE | Exact lab image is 2.7.6. Treat as P0 patch/isolation item; do not run destructive reproduction on shared lab state. |
| AMF mobility/handover validation | Inconsistent validation of UE security capabilities/state during handover | Open upstream report against Open5GS 2.7.6; not a CVE and not locally reproduced | Open5GS AMF NGAP/NAS | AMF version; handover traces; AMF logs; upstream src/amf/ngap-handler.c; restart/session loss evidence | U | Potentially relevant to SA handover work, but current UERANSIM single-gNB topology does not reproduce it. |
| NAS identity and algorithms | Identity exposure or downgrade if null modes are accepted in the wrong state | Null SUCI protection; NIA0/NEA0 or EIA0/EEA0 permitted as fallback; static lab secrets | UE, gNB/eNB, AMF/MME, NAS | UE config; AMF/MME algorithm order; NAS PCAP; security-mode events; SUPI/SUCI appearance | A/L | Strong. These are deliberate lab settings, not necessarily product defects. |
| Diameter control plane | On-path observation/modification or unauthorized peer inside trusted network | No_TLS, weak peer admission, flat reachability | S6a/Gx and freeDiameter peers | Peer config; TLS state; CER/CEA peer identity; DWR/DWA churn; message anomalies; firewall rules | A/L | Exact lab configs use TCP/3868 with No_TLS. |
| GTP and packet plane | Rogue or compromised trusted endpoint injects/redirects traffic or abuses tunnel state | Source trust without strong cryptographic peer identity; exposed UDP/2152; excessive container privilege | GTP-C, GTP-U, SGWU/UPF, sgsnemu | Tunnel endpoint inventory; TEID/session correlation; unexpected peers; packet captures; iptables/nftables; container process list | D/A/L | Strong for GTP-U and session correlation; stays lab-only. |
| PFCP | Unauthorized session-control messages or compromised SMF/UPF relationship | Flat N4 reachability, weak peer allowlisting, no independent NF workload identity | SMF/UPF over UDP/8805 | Association changes; peer IP; session establishment/deletion rate; SMF/UPF logs; network policy | A/L | Present inside Docker network; no dedicated adversarial test yet. |
| RAN OAM and configuration | Stolen operator identity or modified eNB/gNB config changes availability, neighbor, slice, or core attachment | Broad OAM access, unsigned config, shared secrets, unsafe remote management | srsRAN, UERANSIM, vendor EMS/NMS, NETCONF/SSH | gNB/eNB YAML/CONF; config hashes; OAM auth; process command line; service unit; change ticket | A/L | Configuration-integrity study only. No production EMS/NMS or real vendor RAN. |
| Cloud/NFV/container layer | Orchestrator or host compromise changes NF image, config, network, or secrets | Privileged/root container, Docker socket/admin access, unpinned image, absent runtime audit | Docker, Kubernetes, NFV MANO, registry | Compose manifests; image digests; docker inspect; daemon events; audit logs; RBAC; admission records; mounted files | A/L | Strong Docker-host exposure; Kubernetes and ETSI NFV MANO absent. |
| UE and baseband | Remote baseband parsing flaw or malicious configuration/profile | Product-specific memory-safety flaw; outdated modem firmware; untrusted carrier profile | Physical UE, modem/baseband, SIM/eSIM | Baseband build; security bulletin; modem crash logs; carrier config; SIM/eSIM lifecycle | Documented vulnerabilities/A | UERANSIM does not emulate a vulnerable chipset. Physical-device track required. |
| Lawful-intercept and mediation | Compromised authorized workflow or mediation environment exposes selected communications/metadata | Privileged access, opaque export path, weak separation or monitoring | LI mediation/delivery function, case-management interface | Case authorization, provisioning change, delivery endpoint, access/export audit, separation-of-duty record | Public impact report/A | Absent. Do not invent product filenames or infer a specific CALEA platform from the FBI wording. |