CVE-2026-37223

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37223.md
https://gitlab.eurecom.fr/mosaic5g/flexric

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-01 17:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-37223

Mitre link : CVE-2026-37223

CVE.ORG link : CVE-2026-37223

JSON object : View

Products Affected

No product.

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-37223", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37223", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T18:50:29.882924Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-01T17:16:58.647", "references": [{"url": "https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37223.md", "source": "cve@mitre.org"}, {"url": "https://gitlab.eurecom.fr/mosaic5g/flexric", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps."}, {"lang": "es", "value": "FlexRIC v2.0.0 contiene una aserci\u00f3n alcanzable en el despachador de mensajes de iApp. El despachador valida los mensajes E2AP entrantes contra una lista blanca de 9 entradas usando assert(). Un atacante remoto no autenticado puede enviar cualquier PDU E2AP decodificable con un tipo de mensaje que no est\u00e9 en la lista blanca para bloquear el proceso de iApp (puerto 36422) a trav\u00e9s de SIGABRT. Dado que iApp y el RIC near-RT comparten un proceso, esto termina todo el servicio RIC y desconecta todos los Nodos E2 y las xApps."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cve@mitre.org"}