Executive brief
FlexRIC, a controller used in 5G radio access networks, contains a flaw that allows a remote attacker to crash the system. By sending a specific type of network message that the software recognizes but has not yet fully implemented, an attacker can trigger an internal error that shuts down the controller. This results in a denial of service, potentially disrupting cellular network operations and management.
Technical details
FlexRIC v2.0.0 (and versions through commit 6a595d8b) contains a reachable assertion failure (CWE-617) within its near-RT RIC component. The vulnerability exists in 'src/ric/msg_handler_ric.c' where several E2AP message types (such as E2nodeConfigurationUpdate and RIC_SUBSCRIPTION_FAILURE) are whitelisted for processing but lead to stub handlers containing unconditional 'assert(0)' calls. A remote, unauthenticated attacker can send a decodable E2AP PDU of these types to SCTP port 36421, causing the process to terminate via SIGABRT. As of the advisory date, no official patch is available; mitigation involves restricting SCTP access to trusted nodes.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b
Timeline
- 2026-06-01: advisory: NVD and researcher advisory published