CVE-2026-37223EPSS p34.8%
CVE-2026-37223CVE-2026-37223
Description
FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.
Scoring
| CVSS | 7.5 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| EPSS | 0.44% probability of exploitation · percentile 34.8% · 2026-06-18T12:00:27Z |
| Last modified | 2026-06-01 |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.