Executive Summary

CVE-2026-37220 is a vulnerability in FlexRIC v2.0.0 where the near-RT RIC crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent.

The problem occurs because the cleanup process assumes there is always a mapping between the SCTP association and an E2 node. If this mapping does not exist, an assertion failure happens, causing the RIC process to terminate.

A remote unauthenticated attacker can exploit this by connecting to the SCTP port 36421, completing the handshake, and then immediately disconnecting without sending any E2AP message, which triggers the crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) by crashing the near-RT RIC process.

An attacker does not need to be authenticated and can trigger the crash remotely by simply connecting and disconnecting from the SCTP port without sending any valid messages.

This can disrupt the normal operation of the FlexRIC system, potentially affecting network functions that rely on the near-RT RIC.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring SCTP connections to the near-RT RIC on port 36421. Specifically, detection involves identifying SCTP handshakes that complete and then immediately disconnect without sending any E2AP messages, which triggers the crash.

To detect such activity, you can use network monitoring tools or commands that capture SCTP traffic on port 36421 and analyze connection patterns.

• Use tcpdump to capture SCTP traffic on port 36421: tcpdump -i <interface> port 36421 and sctp
• Analyze SCTP association states to find connections that establish and close quickly without further E2AP messages.
• Monitor logs of the near-RT RIC process for assertion failures or crashes related to SCTP association cleanup.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves restricting SCTP access to the near-RT RIC on port 36421 to trusted nodes only, preventing unauthenticated attackers from establishing SCTP associations.

Since no upstream fix was available at the time of disclosure, network-level controls such as firewall rules or SCTP access control lists should be implemented to block unauthorized SCTP connections.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0