CVE-2026-37220: FlexRIC v2

Synopsis

This is a denial-of-service vulnerability in FlexRIC v2.0.0, specifically in its near-RT RIC (Radio Intelligent Controller) component. The flaw is reachable over the network with no authentication required: an attacker completes an SCTP handshake on port 36421 and immediately drops the connection before sending any E2AP message, triggering a failed assert() that crashes the process. Successful exploitation causes a full service disruption of the near-RT RIC, taking down the O-RAN control plane for any connected E2 nodes. HarborGuard is tracking this advisory for patch availability since no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the near-RT RIC service over the network; port 36421 must be accessible from the attacker's position.

• AuthenticationNot required

  No credentials or session tokens are needed; completing the SCTP three-way handshake is sufficient to trigger the crash.

• Victim interactionNot required

  The crash is triggered entirely by the attacker's own connection and disconnection sequence, with no action required from any user or operator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to open and close an SCTP connection, with no timing constraints or environmental dependencies.

Blast Radius

• Crashes the near-RT RIC process, immediately halting all E2 interface control-plane operations for connected RAN nodes.
• Takes down O-RAN network intelligence functions that depend on the near-RT RIC, interrupting policy enforcement and real-time RAN management for the duration of the outage.
• Allows repeated triggering on process restart, enabling a sustained denial-of-service with minimal attacker effort.