4 Critical

>>> Research Division

Research
Intelligence

Protocol-level vulnerability analysis across 3GPP signaling stacks, core network interfaces, and radio access layers. Every vector catalogued. Every procedure animated.

11Protocols
43Attack Vectors
7Signaling Stacks
3GPP · GSMA · RFCCoverage
4Critical
6High
Vulnerability Analysis
Protocol Deep Dives
11protocols

Per-protocol vulnerability catalogues, animated call-flow procedures, and attack taxonomies. SS7 through 5G SBA.

Enter module
Field Reproductions
Reproductions
0tracked

Published talks, papers, and CVEs the team investigates and reproduces — with full attribution to the original researchers.

Enter module
Endpoint Auditing
Client Auditing
7tools

Endpoint and subscriber-equipment audits — baseband firmware, UE capability profiling, SIM/eSIM provisioning, and mobile app surface review.

Enter module
Hardware Security
Device Security
4modules

Hardware attack-surface analysis for identity modules and Massive IoT — UICC/APDU internals and NB-IoT / LTE-M protocol auditing.

Enter module
Protocol Threat Matrix
11 protocols · sorted by severity
CRITICALHIGHMEDIUMLOW
SIG-GSMCRITICAL

GSM Air Interface

2G

Um air interface - IMSI catchers, A5/0 cipher downgrade, COMP128v1 SIM cloning, unauth backhaul.

UmA5IMSI
6vectors
SIG-SS7CRITICAL

SS7 / MAP

2G · 3G

Legacy TDM signaling - geolocation, call intercept, SMS hijack via MAP operations.

MAPSCCPMTP3
5vectors
SIG-CAMHIGH

CAMEL / CAP

2G · 3G

Intelligent Network protocol - prepaid bypass, call redirect, VLR manipulation via CAP.

CAPgsmSCFIN
4vectors
SIG-DIACRITICAL

Diameter

4G · IMS

S6a/Cx/Gx interfaces - auth vector theft, subscriber tracking, QoS manipulation.

S6aAVPHSS
4vectors
SIG-SIPHIGH

SIP / VoLTE

4G · VoLTE

VoLTE signaling - REGISTER hijack, SDP media redirect, INVITE flooding, CLI spoofing.

REGISTERP-CSCFIMS-AKA
4vectors
SIG-GTPCRITICAL

GTP-C / GTP-U

3G · 4G · 5G

Tunnelling protocol - Create Session spoofing, TEID injection, IMSI enumeration.

TEIDSGWUPF
4vectors
SIG-STRHIGH

SIGTRAN / SCTP

3G · 4G

SS7-over-IP transport - ASP registration abuse, OPC spoofing, SCTP ABORT floods.

M3UASCTPSGP
4vectors
ARCH-EPCHIGH

4G EPC

4G LTE

MME, SGW, PGW architecture - S1-AP abuse, bearer session manipulation.

MMES-GWP-GW
3vectors
ARCH-IMSHIGH

IMS Core

4G · VoLTE

HSS, P/I/S-CSCF architecture - VoLTE interception, registration storm attacks.

CSCFHSSCx
3vectors
ARCH-5GCHIGH

5G SBA

5G NR

Service-Based Architecture - NF spoofing, network slicing bypass, SBI HTTP/2 attacks.

AMFSMFNRF
4vectors
ARCH-RANMEDIUM

RAN Structure

4G · 5G

Radio Access Network - X2/Xn handover abuse, F1-AP protocol exposure, NGAP attacks.

gNBCU/DUNGAP
2vectors