diff --git a/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml b/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml
index 90cf7d0d5e2997eba1bf5fdc1856e4292b8c00b3..70a67346a7f61f911b3958186a2fa6c4959e8a07 100644
--- a/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml
@@ -137,7 +137,7 @@ services:
                                     --uicc0.imsi 208990100001100
                                     --rfsimulator.serveraddr 192.168.71.171
                                     --rfsimulator.options chanmod
-                                    --telnetsrv --telnetsrv.listenaddr 192.168.71.181
+                                    --telnetsrv --telnetsrv.shrmod ciUE --telnetsrv.listenaddr 192.168.71.181 --telnetsrv.listenport 8091
         depends_on:
             - oai-du
         networks:
diff --git a/common/utils/telnetsrv/CMakeLists.txt b/common/utils/telnetsrv/CMakeLists.txt
index a7a364d80e3b25156930f0788518bf47464ff59b..7f2d7a02e56daa9a85e2bd1a9fdb7ef4eca5d43b 100644
--- a/common/utils/telnetsrv/CMakeLists.txt
+++ b/common/utils/telnetsrv/CMakeLists.txt
@@ -59,6 +59,11 @@ add_library(telnetsrv_ci MODULE telnetsrv_ci.c)
 target_link_libraries(telnetsrv_ci PRIVATE asn1_nr_rrc_hdrs asn1_lte_rrc_hdrs)
 add_dependencies(telnetsrv telnetsrv_ci)
 
+message(STATUS "Add CI specific telnet functions for nrUE in telnetsrv_ciUE.so")
+add_library(telnetsrv_ciUE MODULE telnetsrv_ciUE.c)
+target_link_libraries(telnetsrv_ciUE PRIVATE asn1_nr_rrc_hdrs asn1_lte_rrc_hdrs)
+add_dependencies(telnetsrv telnetsrv_ciUE)
+
 message(STATUS "Add bearer specific telnet functions in libtelnetsrv_bearer.so")
 add_library(telnetsrv_bearer MODULE telnetsrv_bearer.c)
 target_link_libraries(telnetsrv_bearer PRIVATE asn1_nr_rrc_hdrs asn1_lte_rrc_hdrs)
@@ -70,7 +75,7 @@ target_link_libraries(telnetsrv_rrc PRIVATE asn1_nr_rrc_hdrs asn1_lte_rrc_hdrs)
 add_dependencies(telnetsrv telnetsrv_rrc)
 
 # all libraries should be written to root build dir
-set_target_properties(telnetsrv telnetsrv_enb telnetsrv_5Gue telnetsrv_ci telnetsrv_bearer telnetsrv_rrc
+set_target_properties(telnetsrv telnetsrv_enb telnetsrv_5Gue telnetsrv_ci telnetsrv_ciUE telnetsrv_bearer telnetsrv_rrc
                       PROPERTIES LIBRARY_OUTPUT_DIRECTORY ../../..
 )
 
diff --git a/common/utils/telnetsrv/telnetsrv_ci.c b/common/utils/telnetsrv/telnetsrv_ci.c
index 0f56f72cfd493b167517194d74f158d1fcb50740..9f3c03c39a510db2ad4fcd3ab8f0befde35ffe83 100644
--- a/common/utils/telnetsrv/telnetsrv_ci.c
+++ b/common/utils/telnetsrv/telnetsrv_ci.c
@@ -19,6 +19,11 @@
  *      contact@openairinterface.org
  */
 
+/*! \file telnetsrv_ci.c
+ * \brief Implementation of telnet CI functions for gNB
+ * \note  This file contains telnet-related functions specific to 5G gNB.
+ */
+
 #include <sys/types.h>
 #include <stdio.h>
 #include <unistd.h>
diff --git a/common/utils/telnetsrv/telnetsrv_ciUE.c b/common/utils/telnetsrv/telnetsrv_ciUE.c
new file mode 100644
index 0000000000000000000000000000000000000000..673d9049694bae09532902db864becad28f47623
--- /dev/null
+++ b/common/utils/telnetsrv/telnetsrv_ciUE.c
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the OpenAirInterface (OAI) Software Alliance under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The OpenAirInterface Software Alliance licenses this file to You under
+ * the OAI Public License, Version 1.1 (the "License"); you may not use this file
+ * except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.openairinterface.org/?page_id=698
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *-------------------------------------------------------------------------------
+ * For more information about the OpenAirInterface (OAI) Software Alliance:
+ * contact@openairinterface.org
+ */
+
+/*! \file telnetsrv_ciUE.c
+ * \brief Implementation of telnet CI functions for nrUE
+ * \author Guido Casati
+ * \date 2024
+ * \version 0.1
+ * \note This file contains telnet-related functions specific to 5G NR UE (nrUE).
+ */
+
+#include <sys/types.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include "openair2/LAYER2/NR_MAC_UE/mac_defs.h"
+#include "openair2/LAYER2/NR_MAC_UE/mac_proto.h"
+
+#define TELNETSERVERCODE
+#include "telnetsrv.h"
+
+#define ERROR_MSG_RET(mSG, aRGS...) do { prnt(mSG, ##aRGS); return 1; } while (0)
+
+/* UE L2 state string */
+const char* NR_UE_L2_STATE_STR[] = {
+#define UE_STATE(state) #state,
+  NR_UE_L2_STATES
+#undef UE_STATE
+};
+
+/**
+ * Get the synchronization state of a UE.
+ *
+ * @param buf    User input buffer containing UE ID
+ * @param debug  Debug flag (not used)
+ * @param prnt   Function to print output
+ * @return       0 on success, error code otherwise
+ */
+int get_sync_state(char *buf, int debug, telnet_printfunc_t prnt)
+{
+  int ue_id = -1;
+  if (!buf) {
+    ERROR_MSG_RET("no UE ID provided to telnet command\n");
+  } else {
+    ue_id = strtol(buf, NULL, 10);
+    if (ue_id < 0)
+      ERROR_MSG_RET("UE ID needs to be positive\n");
+  }
+  /* get sync state */
+  int sync_state = nr_ue_get_sync_state(ue_id);
+  prnt("UE sync state = %s\n", NR_UE_L2_STATE_STR[sync_state]);
+  return 0;
+}
+
+/* Telnet shell command definitions */
+static telnetshell_cmddef_t cicmds[] = {
+  {"sync_state", "[UE_ID(int,opt)]", get_sync_state},
+  {"", "", NULL},
+};
+
+/* Telnet shell variable definitions (if needed) */
+static telnetshell_vardef_t civars[] = {
+  {"", 0, 0, NULL}
+};
+
+/* Add CI UE commands */
+void add_ciUE_cmds(void) {
+  add_telnetcmd("ciUE", civars, cicmds);
+}
+
diff --git a/docker/Dockerfile.nrUE.ubuntu20 b/docker/Dockerfile.nrUE.ubuntu20
index e6f8d45e5301ffcc5fa50979de5931cf3d3c6960..dfbd5f93e640e9aeafc3132dd2ebb2b41e2301da 100644
--- a/docker/Dockerfile.nrUE.ubuntu20
+++ b/docker/Dockerfile.nrUE.ubuntu20
@@ -90,6 +90,7 @@ COPY --from=nr-ue-build \
     /oai-ran/cmake_targets/ran_build/build/libdfts.so \
     /oai-ran/cmake_targets/ran_build/build/libldpc*.so \
     /oai-ran/cmake_targets/ran_build/build/libtelnetsrv.so \
+    /oai-ran/cmake_targets/ran_build/build/libtelnetsrv_ciUE.so \
     /oai-ran/cmake_targets/ran_build/build/libtelnetsrv_5Gue.so \
     /usr/local/lib/
 
diff --git a/openair2/LAYER2/NR_MAC_UE/mac_proto.h b/openair2/LAYER2/NR_MAC_UE/mac_proto.h
index 374d9ca3e6b2953811d89fede305136ff765839c..b8d3fa8f232d14e11629eb810c1315c8faf1faed 100644
--- a/openair2/LAYER2/NR_MAC_UE/mac_proto.h
+++ b/openair2/LAYER2/NR_MAC_UE/mac_proto.h
@@ -300,6 +300,13 @@ void configure_initial_pucch(PUCCH_sched_t *pucch, int res_ind);
 void nr_ue_reset_sync_state(NR_UE_MAC_INST_t *mac);
 void nr_ue_send_synch_request(NR_UE_MAC_INST_t *mac, module_id_t module_id, int cc_id, int cell_id);
 
+/**
+ * @brief   Get UE sync state
+ * @param   mod_id      UE ID
+ * @return      UE sync state
+ */
+NR_UE_L2_STATE_t nr_ue_get_sync_state(module_id_t mod_id);
+
 void init_RA(NR_UE_MAC_INST_t *mac,
              NR_PRACH_RESOURCES_t *prach_resources,
              NR_RACH_ConfigCommon_t *nr_rach_ConfigCommon,
diff --git a/openair2/LAYER2/NR_MAC_UE/main_ue_nr.c b/openair2/LAYER2/NR_MAC_UE/main_ue_nr.c
index a7185ee7d206e1d9c1d384a6bed54660dc3a3294..aa492e222524a650838f3ed7fc00fc38b6ba724a 100644
--- a/openair2/LAYER2/NR_MAC_UE/main_ue_nr.c
+++ b/openair2/LAYER2/NR_MAC_UE/main_ue_nr.c
@@ -112,6 +112,12 @@ void nr_ue_reset_sync_state(NR_UE_MAC_INST_t *mac)
   mac->ra.ra_state = nrRA_UE_IDLE;
 }
 
+NR_UE_L2_STATE_t nr_ue_get_sync_state(module_id_t mod_id)
+{
+  NR_UE_MAC_INST_t *mac = get_mac_inst(mod_id);
+  return mac->state;
+}
+
 NR_UE_MAC_INST_t *nr_l2_init_ue(int nb_inst)
 {
   //init mac here