CVE-2026-37230: FlexRIC v2.0.0 RIC_INDICATION Denial-of-Service Vulnerability

Technical summary

The vulnerability stems from a missing null-pointer guard in FlexRIC's RIC_INDICATION message handler. When the near-RT RIC attempts to look up a ran_func_id in its function registry and the lookup fails, the code returns NULL. In Debug builds, an assert() statement catches this and terminates the process with SIGABRT. In Release builds, the code dereferences the NULL pointer, triggering SIGSEGV. The vulnerability is classified as CWE-476 (Null Pointer Dereference). An unauthenticated, network-adjacent attacker can exploit this by crafting a RIC_INDICATION message with an arbitrary, non-existent ran_func_id value and sending it to the near-RT RIC's listening port (36421).

Business impact

A successful attack disrupts the near-RT RIC's availability, which is critical for real-time RAN control, policy enforcement, and resource optimization in O-RAN deployments. If the RIC crashes, ongoing RAN management functions halt, potentially causing:Service degradation or loss of radio access in affected cells; Cascading failures if the RIC is part of an orchestrated control plane; Difficulty restoring service if automatic restart mechanisms are not in place. For network operators and service providers, this translates to customer impact (dropped calls, data interruption) and operational overhead to recover services.

Affected systems

Mosaic5G FlexRIC v2.0.0 is confirmed affected. Organizations deploying this version of FlexRIC as a near-RT RIC in production or lab O-RAN environments are at risk. The vulnerability requires network access to port 36421 (the RIC's message port); therefore, systems isolated from untrusted networks or behind strict ingress filtering have reduced risk. Verify your FlexRIC version and deployment topology against the vendor's advisory.

Exploitability

Exploitability is straightforward and does not require authentication, specialized knowledge, or user interaction. The attacker needs only network reachability to port 36421 and the ability to craft and transmit a RIC_INDICATION message with an invalid ran_func_id. The CVSS score of 7.5 (HIGH) reflects the high attack vector (network), low complexity, no privilege requirement, and high availability impact. However, the attack is not automated in the wild; successful exploitation depends on the attacker's ability to reach the RIC and understand the RIC_INDICATION message format. In environments where the RIC is protected by network segmentation or firewalls, practical exploitability is lower.

Remediation

Upgrade FlexRIC to a patched version that includes null-pointer validation in the ran_func_id lookup handler. Verify the specific patch version in Mosaic5G's security advisory. Until patching is possible, implement network-level mitigations: restrict access to port 36421 to trusted control plane entities; deploy the near-RT RIC behind a firewall or in a segmented network; monitor RIC process crashes and implement automated restart mechanisms to minimize downtime. Verify the patch against the vendor's advisory before deploying.

Patch guidance

Contact Mosaic5G or consult their security advisory for the recommended patch version. Apply patches during a maintenance window that does not disrupt live O-RAN traffic. Test the patched build in a non-production environment first to confirm that RIC_INDICATION message processing works correctly and that no regressions are introduced. Verify that automatic restart policies are in place in case a crash occurs before the patch can be rolled out.

Detection guidance

Monitor for RIC crashes by tracking process exit codes and SIGABRT/SIGSEGV signals on systems running FlexRIC. Review RIC logs for failed ran_func_id lookups or exception messages prior to crashes. Deploy network-level detection by capturing RIC_INDICATION messages with invalid ran_func_id values using protocol analyzers or O-RAN-aware network sensors; look for messages with ran_func_id values not defined in your registry. Establish baseline availability metrics for the RIC and trigger alerts on unexpected restarts or prolonged downtime. Cross-correlate RIC crashes with incoming network traffic to identify potential attack patterns.

Why prioritize this

This vulnerability should be prioritized because it affects a critical control-plane component (the near-RT RIC) with a HIGH CVSS score (7.5) and high availability impact. It requires no authentication and can be exploited remotely with modest effort. Although it is not yet listed in CISA's KEV catalog (indicating no evidence of active exploitation in the wild as of the publication date), O-RAN deployments are sensitive targets, and the relative simplicity of the exploit makes opportunistic or targeted attacks plausible. Organizations with production O-RAN environments should prioritize patching or deploying compensating controls.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: Attack Vector: Network (AV:N) — the RIC is reachable over the network; Attack Complexity: Low (AC:L) — no special conditions needed; Privileges Required: None (PR:N) — unauthenticated access; User Interaction: None (UI:N) — no user involvement; Confidentiality: None (C:N) — no data exfiltration; Integrity: None (I:N) — no data tampering; Availability: High (A:H) — the RIC process crashes, completely unavailable. The score reflects the real-world severity: an unauthenticated attacker can disable a critical network function with one malformed message. Contextual factors (network isolation, rapid restart capabilities) may lower practical risk but do not change the inherent CVSS score.

Frequently asked questions