PT-2026-45452 · Undefined · Undefined

Minamikotor1 · CVE-2026-37222 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description The software uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs, such as an E2setupRequest with extra optional fields, to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. This occurs because the code requires exact IE counts instead of validating them against the ranges specified by the protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-37222

Affected Products

Undefined

References · 3

• 🔥 https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37222.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37222 · Security Note
• https://gitlab.eurecom.fr/mosaic5g/flexric · Note