FlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_xapp_id() only checks that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying their xapp_id in requests sent to the iApp (port 36422), causing responses to be misrouted to the victim xApp. This can crash the victim xApp, the RIC, or the iApp itself through state inconsistencies in the red-black tree data structure.
References
| Link | Resource |
|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37235.md | Exploit Mitigation Third Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | Product |
Configurations
History
03 Jun 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mosaic5g flexric
Mosaic5g |
|
| References | () https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37235.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://gitlab.eurecom.fr/mosaic5g/flexric - Product | |
| CPE | cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:* |
02 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-284 |
01 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-01 19:16
Updated : 2026-06-03 17:15
NVD link : CVE-2026-37235
Mitre link : CVE-2026-37235
CVE.ORG link : CVE-2026-37235
JSON object : View
Products Affected
mosaic5g
- flexric
CWE
CWE-284
Improper Access Control