CVE Feed

    Dashboard / CVE / CVE-2026-37233

    CVE-2026-37233

    FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.

    Published:Jun 1, 2026
    Last Modified:Jun 3, 2026
    EPS:Jun 1, 2026
    EPSS Score:0.0004
    CVSS Score:7.5

    Affected Products

    Vendor
    Mosaic5g
    Product
    Flexric

    Exploits

    https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37233.md

    Common Weakness Enumeration

    CWE-617 Reachable Assertion

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-37226 (CVSS 7.5) — FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 No…
    CVE-2026-37230 (CVSS 7.5) — FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not…
    CVE-2026-37220 (CVSS 7.5) — FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC …
    CVE-2026-37221 (CVSS 7.5) — FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no correspon…
    CVE-2026-37222 (CVSS 7.5) — FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages.…
    CVE-2026-37224 (CVSS 7.5) — FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp …
    CVE-2026-37227 (CVSS 7.5) — FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E…
    CVE-2026-37223 (CVSS 7.5) — FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incomin…
    CVE-2026-37225 (CVSS 7.5) — FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDef…
    CVE-2026-37228 (CVSS 7.5) — FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function all…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High