CVE-2026-37234: FlexRIC v2

Synopsis

This is a resource-management vulnerability in FlexRIC v2.0.0, an open-source RAN Intelligent Controller framework. The flaw is reachable over the network without any authentication: an attacker opens a single SCTP connection and sends multiple E42_SETUP_REQUEST messages to register several xapp_ids, then disconnects. When the connection drops, only the first xapp_id is cleaned up; the rest persist as stale subscription entries, letting an attacker corrupt internal state or exhaust server resources over repeated cycles. No upstream fix has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable SCTP endpoint is exposed over the network, and an attacker must be able to reach it remotely to send crafted E42_SETUP_REQUEST messages.

• AuthenticationNot required

  No credentials or prior account are needed; the attacker interacts with the service anonymously over a raw SCTP connection.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low: the exploit requires only repeated, well-formed SCTP messages with no race conditions, memory-layout dependencies, or special environmental conditions to satisfy.

Blast Radius

• An attacker leaks persistent subscription state inside the iApp by leaving stale xapp_id entries that should have been removed on disconnect.
• Repeated exploitation cycles accumulate unreclaimed subscription objects, exhausting server-side memory or file-descriptor limits and degrading availability of the RIC platform.
• Stale entries can corrupt the RIC subscription table, causing legitimate xApps to receive incorrect state or fail to register cleanly.
• Integrity of the RAN control plane is weakened because the controller operates on a polluted view of active xApp sessions.