CVE-2026-37222: FlexRIC v2

Synopsis

A denial-of-service vulnerability exists in FlexRIC v2.0.0 caused by hardcoded assertions that check for exact Information Element (IE) counts in decoded E2AP messages. An unauthenticated attacker reachable over the network can send a specially crafted but protocol-valid E2AP PDU containing an unexpected number of IEs, triggering a SIGABRT crash in the near-RT RIC (port 36421) or iApp (port 36422). Successful exploitation crashes the affected service, disrupting RAN intelligent controller operations. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target service over the network; the vulnerable E2AP listener is exposed on TCP/SCTP ports 36421 and 36422.

• AuthenticationNot required

  No credentials or account are needed; the attacker sends unauthenticated E2AP PDUs directly to the listening port.

• Victim interactionNot required

  No user or operator action is required; the crash is triggered entirely by the attacker's inbound network message.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free as long as the port is reachable; no race conditions or special environmental factors are required.

Blast Radius

• Crashes the near-RT RIC process via SIGABRT, taking down the RAN intelligent controller and halting E2 interface processing.
• Crashes the iApp process via SIGABRT, disabling any xApp or iApp workloads that depend on it.
• All availability impact is confined to the affected FlexRIC instance; there is no evidence of data disclosure or data modification from this vulnerability.