Executive brief
FlexRIC, a controller used in Open RAN cellular networks to manage radio applications (xApps), is vulnerable to a denial-of-service attack. An attacker can repeatedly request new application registrations, causing an internal counter to overflow and produce duplicate identification numbers. When the system attempts to register a duplicate ID, the controller crashes, potentially disrupting cellular network management and operations.
Technical details
FlexRIC v2.0.0 (and versions through commit 6a595d8b) contains an integer truncation and wraparound vulnerability in the iApp component. While the internal counter for xapp_id is stored in a 32-bit field, it is assigned using a 16-bit logic that wraps around after approximately 65,530 E42_SETUP_REQUEST messages. A remote attacker can trigger this by repeatedly sending setup requests over SCTP to port 36422. When the counter wraps and generates a duplicate ID, the iApp process hits a uniqueness assertion in map_xapps_sockaddr.c and aborts, resulting in a complete denial of service. No official patch was available at the time of the advisory.
Affected products
- EURECOM FlexRIC 2.0.0 through commit 6a595d8b
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory