CVE-2026-37231: FlexRIC v2

Synopsis

An integer wraparound vulnerability in FlexRIC v2.0.0 allows a remote, unauthenticated attacker to crash the iApp service by exhausting the 16-bit xapp_id counter. The service is reachable over the network on port 36422 without any authentication, and after 65,530 or more E42_SETUP_REQUEST connections the counter wraps, producing duplicate xapp_ids that corrupt the internal registration structure. Successful exploitation causes a denial of service, taking down the iApp and any xApp registrations it manages. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach port 36422 on the iApp over the network; any host with a routable path to that port can send E42_SETUP_REQUEST messages.

• AuthenticationNot required

  No credentials or session token are needed; the registration endpoint accepts connections from unauthenticated remote clients.

• Victim interactionNot required

  The attacker sends crafted requests directly to the service with no need for an operator or user to take any action.

• Attack complexityDetail

  The exploit is mechanically straightforward and condition-free: the attacker simply opens and repeats connections until the 16-bit counter wraps, which requires volume but no timing precision or special environment state.

Blast Radius

• Crashes the iApp process on port 36422, immediately halting all xApp registration and management operations.
• Any xApps that depend on the iApp for lifecycle management lose their registration state and become non-functional until the service is manually restarted.
• Repeated attacks keep the iApp unavailable indefinitely, preventing recovery without network-level controls blocking the attacker.