CVE-2026-37233: FlexRIC v2

Synopsis

Authorization bypass in FlexRIC v2.0.0 allows any authenticated-or-unauthenticated xApp connected to the iApp interface to delete subscriptions belonging to other xApps. The flaw is reachable over the network on port 36422 with no authentication required and no user interaction needed, derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation breaks multi-tenant xApp isolation and causes a denial of service by forcibly deleting another xApp's active RIC subscriptions. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable iApp interface listens on port 36422 and is reachable over the network, so an attacker must be able to send TCP traffic to that port.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no credentials or account privileges are needed to send a malicious E42_RIC_SUBSCRIPTION_DELETE_REQUEST.

• Victim interactionNot required

  The CVSS vector specifies UI:N, so the attacker does not need any action from an operator or user to trigger the bug.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions beyond network access to port 36422.

Blast Radius

• A malicious xApp deletes active RIC subscriptions belonging to any other xApp sharing the same iApp instance, immediately severing their data flows.
• Targeted xApps lose all subscription state they had established, forcing them into a degraded or non-functional operating mode until subscriptions are manually re-established.
• In deployments with multiple tenants or operators sharing a single RIC, one compromised or malicious xApp can disrupt the entire multi-xApp environment without elevated privileges.