CVE-2026-37220
FlexRIC v2.0.0 SCTP Association Crash via Premature Disconnection
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mosaic5g | flexric | 2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-37220 is a vulnerability in FlexRIC v2.0.0 where the near-RT RIC crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent.
The problem occurs because the cleanup process assumes there is always a mapping between the SCTP association and an E2 node. If this mapping does not exist, an assertion failure happens, causing the RIC process to terminate.
A remote unauthenticated attacker can exploit this by connecting to the SCTP port 36421, completing the handshake, and then immediately disconnecting without sending any E2AP message, which triggers the crash.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) by crashing the near-RT RIC process.
An attacker does not need to be authenticated and can trigger the crash remotely by simply connecting and disconnecting from the SCTP port without sending any valid messages.
This can disrupt the normal operation of the FlexRIC system, potentially affecting network functions that rely on the near-RT RIC.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring SCTP connections to the near-RT RIC on port 36421. Specifically, detection involves identifying SCTP handshakes that complete and then immediately disconnect without sending any E2AP messages, which triggers the crash.
To detect such activity, you can use network monitoring tools or commands that capture SCTP traffic on port 36421 and analyze connection patterns.
- Use tcpdump to capture SCTP traffic on port 36421: tcpdump -i <interface> port 36421 and sctp
- Analyze SCTP association states to find connections that establish and close quickly without further E2AP messages.
- Monitor logs of the near-RT RIC process for assertion failures or crashes related to SCTP association cleanup.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves restricting SCTP access to the near-RT RIC on port 36421 to trusted nodes only, preventing unauthenticated attackers from establishing SCTP associations.
Since no upstream fix was available at the time of disclosure, network-level controls such as firewall rules or SCTP access control lists should be implemented to block unauthorized SCTP connections.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.