What is the CVSS score of CVE-2026-37223?

CVE-2026-37223 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37223?

FlexRIC v2.0.0 contains a critical remote denial of service vulnerability (CVE-2026-37223) that allows unauthenticated attackers to crash the entire near-RT RIC service by sending unexpected E2AP…

How to fix or mitigate CVE-2026-37223?

Within 24 hours: Restrict network access to TCP port 36422 to trusted control networks only; implement firewall rules if FlexRIC is currently internet-accessible. Within 7 days: Contact FlexRIC vendor to confirm patch timeline and request interim hotfixes; document all FlexRIC v2.0.0 deployments in your inventory. Within 30 days: Evaluate and execute migration to a patched FlexRIC version or deploy additional network admission controls that validate E2AP message types before reaching the RIC service.

FlexRIC CVE-2026-37223

EUVD-2026-33697 HIGH

Reachable Assertion (CWE-617)

2026-06-01 mitre

GHSA-rjvj-4gpj-2wgr

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 21:22 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.

AnalysisAI

Remote unauthenticated denial of service in FlexRIC v2.0.0 allows attackers to crash the entire near-RT RIC service by sending any decodable E2AP PDU with a message type outside the 9-entry whitelist to TCP port 36422. The iApp dispatcher uses assert() for validation, so an unexpected message type triggers SIGABRT in the shared iApp/RIC process, disconnecting all E2 Nodes and xApps. No public exploit identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) and high availability impact make this a credible operational risk for O-RAN testbeds and lab deployments.

Technical ContextAI

FlexRIC is Eurecom's open-source implementation of the O-RAN near-real-time RAN Intelligent Controller (near-RT RIC), used in 5G O-RAN research and testbed deployments. The iApp component is the internal application interface that dispatches E2AP (E2 Application Protocol) messages received from connected E2 Nodes (gNBs/eNBs) on port 36422. The root cause maps to CWE-617 (Reachable Assertion): the message dispatcher uses assert() rather than graceful error handling to validate incoming E2AP message types against a hardcoded 9-entry whitelist. Because iApp and the near-RT RIC run inside a single process, any assertion failure terminates not just the message handler but the entire control-plane service.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references - the GitLab project URL and the third-party advisory at github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37223.md should be monitored for an upstream fix replacing assert() with proper error handling and message rejection. Until a patched build is available, compensating controls include restricting TCP/36422 with host or network firewall rules so only authorized E2 Node IPs can connect (trade-off: requires accurate inventory of legitimate gNB/eNB sources and breaks ad-hoc testbed connections), placing the RIC on a dedicated management VLAN isolated from any untrusted network (trade-off: re-architecture effort), and adding a process supervisor such as systemd with Restart=always to reduce mean time to recovery after a SIGABRT (trade-off: does not prevent repeated attacks and may mask exploitation). Monitor iApp process exits and SIGABRT signals as a detection signal for attempted exploitation.