Uncovering Hidden Paths in 5G: Exploiting Protocol Tunneling and Network Boundary Bridging

5G networks are designed with a clear separation between control and user planes, interfaces, and core functions—each expected to operate within isolated trust boundaries. When these boundaries are not properly enforced, malicious traffic from user equipment can traverse unintended paths and reach sensitive components. This work demonstrates how an attacker-controlled UE can exploit such weaknesses using protocol tunneling and network boundary bridging to bypass isolation and interact with internal elements of the 5G core.