What is the CVSS score of CVE-2026-37225?

CVE-2026-37225 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37225?

Telecommunications operators deploying FlexRIC v2.0.0 for O-RAN network control face an immediately exploitable vulnerability that can crash the RIC's iApp process without authentication, creating…

How to fix or mitigate CVE-2026-37225?

Within 24 hours: Identify all FlexRIC v2.0.0 deployments; restrict TCP port 36422 access via firewall to only authorized E2 nodes and RIC management systems; enable alerting on E42_RIC_SUBSCRIPTION_REQUEST messages. Within 7 days: Implement rate limiting on E42 subscription requests at the application boundary; contact FlexRIC vendor to establish patch timeline and interim updates; baseline current E42 traffic patterns for anomaly detection. Within 30 days: Apply FlexRIC security patch immediately upon vendor release; execute controlled production upgrade with rollback plan; deploy secondary E2AP message validation at network boundary devices as permanent defense-in-depth control.

FlexRIC CVE-2026-37225

EUVD-2026-33699 HIGH

Reachable Assertion (CWE-617)

2026-06-01 mitre

GHSA-65q7-226q-8whm

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 21:22 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.

AnalysisAI

Remote denial-of-service in FlexRIC v2.0.0 allows unauthenticated network attackers to crash the iApp process listening on TCP port 36422 by sending a malformed E42_RIC_SUBSCRIPTION_REQUEST containing an empty ricEventTriggerDefinition field. The bug stems from inconsistent validation between the E42 decoder and the downstream E2AP encoder, which aborts via SIGABRT on the missing constraint. No public exploit identified at time of analysis, but the trivial trigger condition (single crafted message, no authentication) makes opportunistic disruption of O-RAN near-RT RIC deployments realistic.

Technical ContextAI

FlexRIC is EURECOM's open-source implementation of the O-RAN near-real-time RAN Intelligent Controller (near-RT RIC) and its associated E2 application interface used in 5G/O-RAN research and pre-production testbeds. The vulnerability lives at the boundary between two protocol layers: the E42 interface, a FlexRIC-specific message channel between the RIC and its xApps/iApps, and the standardized E2AP (E2 Application Protocol) that the iApp uses when forwarding subscription requests onward. CWE-617 (Reachable Assertion) applies because the E42 decoder accepts an E2_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition while the E2AP encoder later enforces a non-empty ASN.1 constraint, hitting an assert() that calls abort(). This cross-layer validation mismatch is a classic asymmetry pattern in ASN.1-based telecom stacks where two codecs disagree on field optionality.

RemediationAI

No vendor-released patch version was identified in the supplied references at time of analysis, so monitor https://gitlab.eurecom.fr/mosaic5g/flexric for upstream commits addressing the E42/E2AP validation mismatch and the advisory at https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37225.md for fix references. As compensating controls, restrict TCP/36422 to trusted RIC management subnets using a host or network firewall (side effect: blocks any legitimate remote xApp/iApp clients that connect over E42), deploy the iApp behind a mutually authenticated transport or VPN so untrusted peers cannot reach the decoder (adds operational complexity for testbed users), and run the iApp under a supervisor such as systemd with Restart=on-abort to reduce mean time to recovery (side effect: masks repeated crashes from monitoring unless alerting on restart frequency). A local hotfix patch rejecting empty ricEventTriggerDefinition fields at the E42 decoder layer is the minimal source-level mitigation for operators able to rebuild from source.