CVE-2026-37224: FlexRIC v2

Synopsis

An unauthenticated denial-of-service vulnerability affects FlexRIC v2.0.0, an open RAN controller component. A remote attacker with network access to port 36421 can crash the iApp process by sending two E2_SETUP_REQUEST messages that share the same E2 node configuration, triggering an abort signal via a misused assert() call in the iApp registry. Successful exploitation terminates the iApp process, disrupting the O-RAN near-real-time control plane. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach port 36421 over the network; the iApp process listens for E2 interface connections and is exposed to any host that can route to it.

• AuthenticationNot required

  No credentials or session token are needed; the E2_SETUP_REQUEST is processed before any authentication step is enforced.

• Victim interactionNot required

  The crash is triggered entirely by the attacker sending two crafted messages; no action from an operator or user is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending two E2_SETUP_REQUEST messages with identical node configuration is sufficient to trigger SIGABRT on every attempt.

Blast Radius

• Crashes the FlexRIC iApp process, taking down the near-real-time RAN controller and severing control-plane communication with all connected E2 Nodes.
• Disrupts any xApp or iApp workload depending on the iApp registry, halting policy enforcement and RAN configuration updates until the process is manually restarted.
• Enables a persistent denial-of-service loop: the attacker can repeatedly trigger the crash each time the process is restarted, as no rate-limiting or graceful rejection exists in the affected code path.