CVE-2026-37235: FlexRIC E42 Message Authentication Bypass – RIC Denial of Service

Technical summary

The vulnerability stems from improper input validation in FlexRIC's E42 message processing logic. The valid_xapp_id() function performs only a range check on the xapp_id field extracted from incoming E42 payloads, without binding that identifier to the SCTP association over which the message arrived. An unauthenticated remote attacker can send a crafted E42 message to the iApp listening on port 36422, specifying an arbitrary xapp_id value. The iApp then routes responses to the victim xApp based on this untrusted identifier, leading to message misrouting. The victim xApp receives responses it did not request, causing state machine violations in the red-black tree data structure used internally, ultimately leading to denial of service through crash or resource exhaustion.

Business impact

RIC deployments using FlexRIC v2.0.0 face denial of service risk to their xApp ecosystem and core RIC infrastructure. An attacker with network access to the iApp port can selectively disrupt or crash critical xApps without authentication, potentially affecting radio resource management, network optimization, or other real-time RAN intelligence functions. If the RIC itself or the iApp crashes, the entire intelligent RAN control plane becomes unavailable until recovery, causing loss of dynamic network optimization and monitoring capabilities. This impacts service quality for radio access networks relying on automated RIC-driven decisions.

Affected systems

The vulnerability affects FlexRIC v2.0.0 from mosaic5g. Organizations running this version should assume their systems are at risk if the iApp service (port 36422) is reachable from untrusted network segments. Verify your FlexRIC deployment version against the product documentation. Later versions may contain fixes; consult the mosaic5g security advisories for confirmation of patched releases.

Exploitability

Exploitability is high. The attack requires only network access to port 36422; no authentication, credentials, or user interaction are needed. The valid_xapp_id() check is trivial to bypass—an attacker simply needs to discover or guess a valid xApp ID from the assigned range (which may be deterministic or easily enumerated). The CVSS 3.1 score of 7.5 (HIGH) reflects these factors: network-based attack vector, low attack complexity, no privileges required, no user interaction, and high availability impact with no confidentiality or integrity compromise.

Remediation

Upgrade FlexRIC to a patched version that implements sender association binding. The fix must validate that the xapp_id in an E42 message matches the xApp actually connected over the SCTP association carrying that message, not just that the ID falls within a valid range. Until patching is possible, implement network controls: restrict access to port 36422 to only trusted xApp endpoints, use firewall rules to isolate the iApp from untrusted network segments, and monitor for unexpected xApp connections or misrouted messages.

Patch guidance

Contact mosaic5g or consult the official FlexRIC security advisories to identify the minimum patched version addressing CVE-2026-37235. Test the patched release in a non-production RIC environment to ensure compatibility with your xApp topology and RIC configuration before deploying to production. Verify that the patch implements cryptographic or association-level binding of xapp_id to the sender's SCTP connection, not merely a different range check.

Detection guidance

Monitor iApp logs and packet captures for E42 messages with xapp_id values that do not correspond to known connected xApps. Track SCTP association state and flag any xapp_id in an incoming message that mismatches the SCTP peer address. Watch for unexplained xApp crashes or state machine errors in the red-black tree (consult RIC logs for data structure corruption warnings). Consider deploying network intrusion detection signatures that identify forged E42 messages by correlating xapp_id values with actual SCTP peer identities.

Why prioritize this

Despite not appearing on the CISA KEV catalog, this vulnerability merits immediate attention because it enables unauthenticated network-based denial of service to critical RAN intelligence infrastructure with minimal attack effort. RIC systems are central to modern mobile network automation; their compromise affects radio access quality across multiple services. The lack of authentication and the trivial complexity of the exploit offset the fact that impact is limited to availability (no data exfiltration). Organizations operating production RICs should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) correctly reflects a remotely exploitable vulnerability with no authentication or user interaction barriers. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H captures: network-wide attack surface, straightforward exploitation, and severe availability impact. The absence of confidentiality and integrity compromise prevents a CRITICAL rating, but the ease of exploitation and impact on infrastructure availability justify HIGH priority in a RIC deployment context.

Frequently asked questions