Executive brief
EURECOM FlexRIC, a controller used in 5G radio access networks, is vulnerable to a remote crash. An attacker can send a specific sequence of duplicate connection requests to the system, causing the controller process to shut down unexpectedly. This results in a denial of service, disrupting the management of the cellular network infrastructure.
Technical details
A reachable assertion vulnerability (CWE-617) exists in FlexRIC v2.0.0 within the E2 node registry component (src/lib/msg_hand/reg_e2_nodes.c). The function add_reg_e2_node() uses an assert() statement to enforce GlobalE2node_ID uniqueness instead of implementing graceful error handling for duplicate registrations. A remote, unauthenticated attacker can trigger this assertion by sending two E2_SETUP_REQUEST messages with the same node configuration over SCTP to port 36421. This causes the iApp process to receive a SIGABRT signal and terminate, leading to a complete denial of service. As of the advisory date, no official patch is available, and users are advised to restrict SCTP access to trusted nodes.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory