PT-2026-45513 · Git+1 · Flexric
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
FlexRIC version 2.0.0
Description
An issue exists where the software trusts the
xapp id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid xapp id() only verifies that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying a target xapp id in requests sent to the iApp endpoint on port 36422. This leads to responses being misrouted to the victim xApp, which can cause the victim xApp, the RIC, or the iApp to crash due to state inconsistencies in the red-black tree data structure, a self-balancing binary search tree used for efficient data storage and retrieval.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flexric