CVE-2026-37225: FlexRIC v2

Synopsis

A denial-of-service vulnerability exists in FlexRIC v2.0.0, an open-source near-RT RAN Intelligent Controller. An unauthenticated attacker reachable over the network can send a crafted E42_RIC_SUBSCRIPTION_REQUEST message with an empty ricEventTriggerDefinition field, triggering a cross-layer validation mismatch that causes the iApp process to crash via SIGABRT on port 36422. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iApp service over the network; the vulnerable endpoint listens on port 36422 and is exposed to any network-accessible client.

• AuthenticationNot required

  No credentials or session token are needed; the malformed subscription request can be sent by any unauthenticated client.

• Victim interactionNot required

  The crash is triggered entirely by the attacker sending a single crafted message; no action by a legitimate user is required.

• Attack complexityDetail

  Exploit reliability is high and condition-free; the attacker only needs to send a well-formed E42 message with the ricEventTriggerDefinition field left empty, with no race conditions or memory-layout dependencies.

Blast Radius

• Crashes the iApp process with SIGABRT, taking down the near-RT RIC control plane for all connected E2 nodes until the process is restarted.
• Disrupts active RAN Intelligent Controller subscriptions, interrupting any xApps or management functions that depend on E2 event reporting.
• Repeated sends allow an attacker to keep the iApp unavailable indefinitely, effectively denying RIC service to the entire deployment.