Executive brief
FlexRIC, a software platform used to manage and control cellular radio networks, is vulnerable to a remote attack that can crash the system. By sending a specially crafted subscription request with missing data, an attacker can force the application to shut down unexpectedly. This results in a denial of service, disrupting the management of the radio network and potentially impacting mobile connectivity services.
Technical details
A reachable assertion (CWE-617) exists in FlexRIC v2.0.0 due to a cross-layer validation mismatch between the E42 and E2AP protocols. The E42 layer decoder (src/lib/e2ap/v3_01/dec/e2ap_msg_dec_asn.c) accepts an E42_RIC_SUBSCRIPTION_REQUEST even if the ricEventTriggerDefinition field is empty. However, when the iApp attempts to forward this request, the E2AP encoder (src/lib/e2ap/v3_01/enc/e2ap_msg_enc_asn.c) triggers a SIGABRT via a non-empty constraint assertion. A remote, unauthenticated attacker can exploit this by sending a malformed SCTP packet to port 36422, causing the iApp process to terminate.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b
Timeline
- 2025-11-12: other: Vulnerability confirmed present in commit 6a595d8b
- 2026-06-01: disclosed: CVE published and advisory released by researcher