CVE-2026-37227: FlexRIC v2.0.0 Near-RT RIC Denial of Service (CWE-617)

Technical summary

FlexRIC v2.0.0 contains reachable assert(0) statements in stub message handlers for E2AP protocol data units (PDUs) that are whitelisted during initial validation but unimplemented at the handler level. Specifically, message types such as E2nodeConfigurationUpdate pass the protocol whitelist check but trigger a CWE-617 (Reachable Assertion) condition when the handler attempts to process them. An unauthenticated remote attacker can send a decodable E2AP PDU of an unimplemented-but-whitelisted type to the near-RT RIC process listening on port 36421, causing immediate termination via SIGABRT signal. The root cause is a mismatch between whitelist scope and stub handler implementation.

Business impact

Availability of the near-RT RIC is severely compromised. Since the RIC is a core orchestration component in 5G/6G radio access networks, a crash results in loss of dynamic control over connected base stations and user plane optimization until the service is manually restarted. In production environments, this translates to radio resource allocation failures, degraded QoS, and potential service interruptions across the controlled RAN domain. The ease of exploitation (unauthenticated, network-accessible) means that both external attackers and compromised internal systems can trigger denial of service.

Affected systems

FlexRIC v2.0.0 is affected. The vulnerability is specific to the near-RT RIC component listening on port 36421. Verify with your vendor which deployment versions correspond to v2.0.0 and which prior or later versions may contain similar patterns. Organizations using FlexRIC in production RAN environments should inventory their deployed versions immediately.

Exploitability

Exploitability is high. No authentication is required, the attack vector is network-based, the attack complexity is low (a valid E2AP PDU of an unimplemented type is trivial to craft), and user interaction is not needed. An attacker needs only network reachability to port 36421 and basic knowledge of the E2AP protocol structure. Public E2AP specifications and codec libraries make message construction straightforward. No user action or special privileges are required on the target.

Remediation

Immediately apply a vendor patch that either (1) removes the assert(0) statements and replaces them with graceful error handling, (2) implements the stub handlers for whitelisted message types, or (3) removes unimplemented message types from the whitelist. Verify the exact patch version and deployment method against your vendor's advisory. Until patching is possible, network segmentation and access controls on port 36421 can reduce exposure by limiting which systems can send E2AP traffic to the RIC.

Patch guidance

Contact your FlexRIC vendor for a patched version addressing CWE-617 in the E2AP message handler. Patch testing should confirm that E2nodeConfigurationUpdate and other previously unimplemented message types are either handled gracefully or rejected at the whitelist stage without assertion. Verify patch applicability to your exact FlexRIC version before deployment. Follow your organization's change control process for RIC updates, as crashes during deployment can disrupt RAN operations.

Detection guidance

Monitor for unexpected SIGABRT or process crashes of the FlexRIC near-RT RIC service on port 36421. Implement network telemetry on port 36421 to detect anomalous E2AP traffic patterns, particularly E2nodeConfigurationUpdate messages from unexpected sources. Check RIC application logs for assertion failures or unhandled message type warnings. A spike in RIC restarts without corresponding maintenance activity is a strong indicator of active exploitation. Alert on any remote connection attempts to port 36421 from untrusted network segments.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS 3.1 score (7.5), network accessibility, lack of authentication requirements, and direct impact on RAN availability. Although not currently in CISA's KEV catalog, the ease of exploitation and the critical role of the RIC in 5G operations mean rapid weaponization is plausible. Organizations dependent on FlexRIC should treat this as urgent regardless of KEV status.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated denial-of-service vector with no complexity barriers. The score appropriately penalizes the lack of confidentiality and integrity impact (both N) but assigns high weight to availability impact (A:H), since the RIC process terminates on each successful message. The base score does not account for compensating controls (network segmentation, port restrictions) that may be in place; actual risk is context-dependent on deployment architecture and threat modeling.

Frequently asked questions