Executive brief
FlexRIC is a software controller used in Open RAN (O-RAN) cellular networks to manage radio resources. A vulnerability in its message handling component allows a remote attacker to crash the entire controller by sending a specially crafted network message. This results in a complete service outage, disconnecting all connected cellular base stations and applications.
Technical details
A Reachable Assertion (CWE-617) exists in the FlexRIC iApp message dispatcher within 'src/ric/iApp/msg_handler_iapp.c'. The 'e2ap_msg_handle_iapp' function validates incoming E2AP message types against a 9-entry whitelist using the 'assert()' macro. A remote, unauthenticated attacker can send a decodable E2AP Protocol Data Unit (PDU) with a message type not present in the whitelist to SCTP port 36422. This triggers a SIGABRT, crashing the iApp process. Because the iApp and the near-RT RIC typically share a single process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps. No patch was available at the time of disclosure; mitigation involves restricting access to port 36422.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12)
Timeline
- 2026-06-01: advisory: NVD and researcher advisory published