CVE-2026-37223: FlexRIC v2

Synopsis

Reachable-assertion denial of service in FlexRIC v2.0.0 affects the iApp message dispatcher. A remote, unauthenticated attacker can send a valid but unlisted E2AP PDU to port 36422, triggering an assert() call that aborts the process via SIGABRT. Because iApp and the near-RT RIC share a single process, the crash terminates the entire RIC service and disconnects all E2 Nodes and xApps. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach port 36422 over the network to deliver a malformed E2AP PDU to the iApp dispatcher.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable code path is exercised by any unauthenticated network sender.

• Victim interactionNot required

  No user action is required; the crash is triggered purely by the attacker sending the crafted packet.

• Attack complexityDetail

  Exploit is reliable and condition-free; any decodable E2AP PDU with a message type outside the 9-entry whitelist is sufficient to trigger the abort.

Blast Radius

• Crashes the iApp process via SIGABRT, taking down the entire near-RT RIC service.
• Disconnects all E2 Nodes that maintain sessions through the RIC, dropping active radio coordination.
• Disconnects all xApps relying on the RIC, disrupting any real-time RAN intelligence or control loops they provide.
• Service remains unavailable until the process is manually or automatically restarted, with no data confidentiality or integrity impact.