PatchSiren cyber security CVE debrief
CVE-2026-37225 Eurecom CVE debrief
A cross-layer validation mismatch in FlexRIC v2.0.0 allows remote unauthenticated attackers to crash the iApp process via SIGABRT. The E42 layer decoder accepts an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field as valid input, but the downstream E2AP encoder enforces a non-empty constraint and triggers an assertion failure when forwarding the request. This results in denial of service on port 36422. The vulnerability was published on 2026-06-01 and carries a HIGH severity CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The weakness is classified as CWE-617: Reachable Assertion. Vendor attribution points to Eurecom as the reference domain candidate for the FlexRIC project, though confidence is low and the vendor field requires review. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.
- Vendor
- Eurecom
- Product
- FlexRIC
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Telecommunications operators deploying O-RAN near-RT RIC infrastructure with FlexRIC; security teams monitoring E2 interface availability; network engineers responsible for RAN function stability
Technical summary
FlexRIC v2.0.0 iApp process listens on port 36422 and handles E42_RIC_SUBSCRIPTION_REQUEST messages. The E42 decoder layer does not enforce non-empty ricEventTriggerDefinition, but the E2AP encoder layer asserts this constraint. A remote attacker sending a crafted request with an empty ricEventTriggerDefinition causes an assertion failure (SIGABRT), terminating the iApp process. Attack vector is network-based, requires no authentication, and has low attack complexity. Impact is limited to availability (no confidentiality or integrity effects per CVSS vector).
Defensive priority
high
Recommended defensive actions
- Upgrade to a patched version of FlexRIC when available; no patched version is confirmed at time of disclosure
- Implement network segmentation to restrict access to iApp port 36422 to authorized E2 nodes and management hosts only
- Monitor for unexpected SIGABRT crashes in iApp process logs that may indicate exploitation attempts
- Validate ricEventTriggerDefinition field presence at the E42 ingress layer as a temporary compensating control if source code modifications are feasible
- Review and strengthen cross-layer validation between E42 decoder and E2AP encoder to prevent assertion-triggering state propagation
Evidence notes
The vulnerability description is sourced from the official CVE record and NVD entry. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is taken from NVD metadata. CWE-617 (Reachable Assertion) is documented in NVD weakness data. Vendor evidence is limited to a reference domain candidate ('Eurecom') with low confidence, flagged for review. The source references include a GitHub security advisory repository and the FlexRIC GitLab repository.
Official resources
2026-06-01T17:16:58.880Z