CVE-2026-37225: FlexRIC v2.0.0 Remote Denial of Service

Technical summary

The vulnerability exists in FlexRIC v2.0.0's handling of E42_RIC_SUBSCRIPTION_REQUEST messages. When a ricEventTriggerDefinition field is empty, the E42 layer decoder does not reject the message. However, when the E2AP encoder attempts to process the forwarded request, it asserts a non-empty constraint on that field. This assertion failure triggers SIGABRT termination of the iApp process listening on port 36422. The root cause is inadequate input validation and lack of cross-layer constraint enforcement before message propagation. No authentication is required to send packets to this port, making the attack surface fully exposed.

Business impact

Organizations running FlexRIC v2.0.0 face immediate service disruption risk. An attacker can remotely crash the iApp without credentials, interrupting RAN (Radio Access Network) control functions that depend on stable subscription management. Repeated exploitation could lead to sustained unavailability, affecting mobile network operations and customer connectivity. The lack of authentication lowers the barrier to attack, making opportunistic exploitation likely if the vulnerability becomes public.

Affected systems

FlexRIC v2.0.0 is affected. The specific iApp process on port 36422 is vulnerable to remote crash via E42_RIC_SUBSCRIPTION_REQUEST messages with empty ricEventTriggerDefinition fields. Verify your deployment version against vendor advisories to confirm scope.

Exploitability

Exploitability is high. The vulnerability requires network access to port 36422, which is unauthenticated, and a simple payload (a subscription request with an empty trigger definition field). No special privileges, user interaction, or complex preconditions are required. An attacker with basic protocol knowledge can craft the malicious packet. Attack complexity is low and can be automated or weaponized easily once the exploit vector is understood.

Remediation

Upgrade FlexRIC to a patched version that implements proper cross-layer input validation. Verify the specific patched version against vendor advisories. As an interim measure, restrict network access to port 36422 to trusted RIC peers and management subnets using firewall rules. Monitor for unexpected subscription requests or abnormal iApp process crashes.

Patch guidance

Contact your FlexRIC vendor or consult their security advisories for the specific patched version addressing CVE-2026-37225. Apply patches to all FlexRIC v2.0.0 deployments as soon as available. Test patches in a non-production environment before production rollout to ensure compatibility with your RAN topology. Enable automatic security updates if your deployment supports it.

Detection guidance

Monitor iApp process terminations and SIGABRT signals on systems running FlexRIC. Log and alert on any E42_RIC_SUBSCRIPTION_REQUEST messages with empty ricEventTriggerDefinition fields. Implement network-level detection by inspecting E2AP traffic for malformed subscription requests from untrusted sources. Baseline normal process uptime and alert on unexplained restarts of the iApp service on port 36422.

Why prioritize this

CVE-2026-37225 merits immediate attention due to its high CVSS score (7.5), network-accessible attack vector, lack of authentication requirement, and direct impact on service availability. While not currently in the KEV catalog, the simplicity of exploitation and potential for large-scale disruption in RAN environments justify rapid remediation prioritization.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack with low complexity that directly impacts availability. Although confidentiality and integrity are not affected, complete denial of service to a critical network control function is a material business risk. The score does not account for environmental factors such as network segmentation or the criticality of RAN operations in your infrastructure—assess and adjust internal risk ratings accordingly.

Frequently asked questions