CVE-2026-37235: FlexRIC v2

Synopsis

An ID spoofing vulnerability in FlexRIC v2.0.0 allows a remote unauthenticated attacker to impersonate any registered xApp by supplying an arbitrary xapp_id in E42 message payloads sent to the iApp on port 36422. Because the valid_xapp_id() function only checks whether the value falls within an assigned range and does not bind it to the sender's SCTP association, there is no way to detect the forgery. Successful exploitation causes misrouted responses that crash the victim xApp, the RIC, or the iApp itself through state corruption in the red-black tree data structure. No upstream fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iApp service over the network on port 36422; no local access or physical presence is needed.

• AuthenticationNot required

  No credentials are required; the attacker sends crafted E42 payloads as an unauthenticated sender.

• Victim interactionNot required

  The vulnerability is triggered entirely by the attacker's own requests; no action from a legitimate user or xApp operator is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to specify a valid-range xapp_id value, which requires no race condition or environmental tuning.

Blast Radius

• Crashes the victim xApp by causing responses intended for it to arrive from an unexpected state, corrupting its internal context.
• Corrupts the red-black tree data structure inside the RIC or iApp, which can bring down the entire RIC platform and disrupt radio network orchestration.
• Enables repeated denial-of-service against any registered xApp without authentication by cycling through valid xapp_id values.
• Disrupts all xApps and network functions that depend on the affected RIC for near-real-time control, extending the blast radius beyond the directly targeted xApp.