The 3 rd Generation Partnership Project (3 GPP), in its different committees, is responsible for transferring these ideas into applicable standards [4]. Many people are already \"enjoying a 5G Symbol\" and better data rates on their smartphones. However, it is widely unknown to the public that in most current 5G deployments, many novel 5G features are missing. In particular, this refers to security mechanisms, such as the new authentication framework, to better protect the privacy of users. Currently, the majority of 5G networks operate in a special transitory mode referred to as 5G Non-Stand-Alone (NSA) [5]. The idea of 5G NSA is to help MNOs to swiftly move from 4G to 5G while reusing the current 4G facilities. The NSA mode of operation allows 5G deployments to utilize LTE core networks and base stations while adding new 5G base stations. 5G NSA enables MNOs to begin offering 5G services, providing higher data speed and capturing additional revenue streams while, in the background, they are implementing their new 5G core infrastructure. It is unclear how long a complete transition from 5G NSA to the fully 5G Stand-Alone (SA) architecture, which includes the new 5G core network, will take. But the latest 5G status update report by the Global Mobile Suppliers Association shows that only 22% of the MNOs worldwide are currently investing in public SA networks [5]. As a result, it is expected that 5G NSA will remain primarily in use in the coming years; thus, its security is critical. The critical nature of the security of 5G NSA networks has prompted research into 4G attacks that can be transferred to 5G NSA networks, with a few attacks having been verified to date. Nevertheless, existing research lacks a comprehensive and systematic study that explores the state of the art, identifies transferable attacks, and categorizes them into a structured taxonomy to provide a holistic understanding. These insights are necessary to develop effective countermeasures tailored to specific attack techniques, rogue devices, or a common root cause. For instance, the shift toward Open Radio networks [6] may offer an opportunity to leverage third-party apps (xApps) for detecting fake base stations--a primary device used in attacks against mobile networks [7; 8; 9; 10; 11; 12]. Moreover, the advent of private 5G networks [13] for Industry 4.0, managed by companies relatively new to the 5G security domain, also adds to the importance of such studies. To address this gap in the literature, we present, to the best of our knowledge, the first taxonomy of attacks on 5G NSA over the radio interface. Through an extensive exploration of the existing literature, we identify transferable attacks and systematically categorize them based on the active or passive nature of the attacker, attack techniques, underlying vulnerabilities, and type of rogue device used. Our study provides a succinct summary of all the attacks, serving as a comprehensive reference and analytical resource. Additionally, it also reveals that 5G NSA may offer a false sense of security, as most enhancements are implemented in 5G SA networks, such as IMSI encryption [14]. To underscore this concern, we implement three attacks with severe consequences (yet to be verified) and successfully validate them on various commercially available smartphones, thereby extending the list of verified attacks to date. Based on our results, we also offer valuable recommendations for companies considering investments in private 5G networks. This paper is structured as follows: In Section 2, we briefly summarize the architecture of 5G NSA networks. Section 3 provides a comprehensive overview of known 4G vulnerabilities and discusses them in the context of 5G NSA networks. We discuss our findings from the literature review in Section 4. Section 5 introduces our testbed and the additional infrastructure which we used to conduct our experiments.