Executive brief
FlexRIC is a software controller used in Open RAN (Radio Access Network) environments to manage cellular network functions. A vulnerability in how it processes network messages allows an unauthenticated remote attacker to crash the controller by sending a specially crafted message. This results in a denial of service, potentially disrupting cellular network management and operations.
Technical details
The vulnerability is classified as CWE-617 (Reachable Assertion). In FlexRIC v2.0.0, specifically within the E2AP message decoder (e.g., e2ap_dec_setup_request in src/lib/e2ap/v3_01/dec/e2ap_msg_dec_asn.c), the code uses hardcoded assert() statements to validate the number of Information Elements (IEs) in a decoded message. A remote unauthenticated attacker can send a valid E2AP PDU via SCTP to port 36421 or 36422 that contains an unexpected number of IEs (such as extra optional fields). Because the decoder asserts exact counts rather than validating against protocol-specified ranges, the process terminates via SIGABRT, causing a denial of service. No official patch was available at the time of disclosure.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12)
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory