Uncovering hidden paths in 5G

5G networks are designed with a clear separation between control and user planes, interfaces, and core functions—each expected to operate within isolated trust boundaries. When these boundaries are not properly enforced, malicious traffic from user equipment can traverse unintended paths and reach sensitive components. This work demonstrates how an attacker-controlled UE can exploit such weaknesses using protocol tunneling and network boundary bridging to bypass isolation and interact with internal elements of the 5G core. To assess the real-world impact of these attack vectors, we evaluated six open-source and commercial 5G core deployments, focusing on how user-plane infrastructure processes adversarial traffic from a UE. Our findings reveal inconsistent enforcement of routing, segmentation, and validation policies—rooted in architectural misconfigurations and specification ambiguities. These systemic issues allow crafted but standards-compliant traffic to cross core boundaries. This led to the discovery of seven vulnerabilities and six previously undocumented weaknesses—including flaws in UPF forwarding logic, incomplete protocol validation, and ambiguous specification behaviors. Building on these insights, we design and evaluate three novel attacks that enable direct data injection into UEs, charging fraud via traffic reflection, and full user traffic interception through a rogue gNodeB. We conclude by outlining practical mitigations, emphasizing the need for strict interface validation and stronger isolation controls in 5G core networks.