CVE-2026-37235 Details
Description
FlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_xapp_id() only checks that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying their xapp_id in requests sent to the iApp (port 36422), causing responses to be misrouted to the victim xApp. This can crash the victim xApp, the RIC, or the iApp itself through state inconsistencies in the red-black tree data structure.
A vulnerability in FlexRIC version 2.0.0 allows remote unauthenticated attackers to impersonate xApps by exploiting the unverified xapp_id field in E42 message payloads. The issue arises because the validation function only ensures that the xapp_id is within a designated range, without confirming its association with the sender's SCTP connection. This flaw can lead to misrouted responses, causing disruptions that may crash the targeted xApp, the near-RT RIC, or the iApp through inconsistencies in the red-black tree data structure.
No upstream fix is currently available. Operators are advised to restrict iApp access to trusted xApps and monitor for requests that claim identities not associated with their SCTP connection. All E42 request handlers should verify xapp_id against the authenticated transport association instead of relying on the payload alone.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37235.md | [email protected] | ExploitMitigationThird Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mosaic5g flexric | 2.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |