Executive brief
FlexRIC, a controller used in Open RAN cellular networks to manage radio access, is vulnerable to a remote crash. An unauthenticated attacker can send a single malformed data packet to the system, causing the entire service to shut down. This results in a denial of service, potentially disrupting cellular network management and operations.
Technical details
A reachable assertion (CWE-617) exists in the e2ap_create_pdu() function within FlexRIC's E2AP message decoding logic. The vulnerability is located in the ASN.1 PER decoding helper, which incorrectly uses an assertion to verify that decoding was successful (RC_OK). Because this assertion is reached before any protocol-level validation, a remote, unauthenticated attacker can trigger a process crash (SIGABRT) by sending a malformed SCTP payload (such as a single 0x00 byte) to ports 36421 or 36422. All E2AP protocol versions (v1.01, v2.03, and v3.01) are affected. As of publication, no official patch is available, and users are advised to restrict SCTP access to trusted peers.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory