Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-37231 is a vulnerability in FlexRIC v2.0.0 caused by inconsistent integer widths used for xapp_id assignment. The system uses a 16-bit counter for assigning xapp_ids but stores these IDs in 32-bit message fields. After about 65,530 assignments, the 16-bit counter wraps around, producing duplicate xapp_ids.

When the iApp receives a duplicate xapp_id during registration, it crashes because its internal data structure detects the duplicate and aborts the process. This can be triggered remotely by repeatedly sending E42_SETUP_REQUEST messages to the iApp's SCTP port 36422.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service (DoS) conditions. Specifically, the iApp crashes when it encounters duplicate xapp_ids caused by the counter wraparound, interrupting normal operation.

An attacker can exploit this by repeatedly connecting and requesting new xApp registrations, causing the iApp to crash and potentially disrupting services relying on FlexRIC.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the volume of E42_SETUP_REQUEST messages sent to the iApp SCTP port 36422. An unusually high number of these setup requests may indicate an attempt to trigger the duplicate xapp_id wraparound issue.

You can use network monitoring tools or commands to observe traffic on port 36422 and count the number of E42_SETUP_REQUEST messages.

• Use tcpdump to capture SCTP traffic on port 36422: tcpdump -i <interface> port 36422
• Filter and count E42_SETUP_REQUEST messages by analyzing captured packets with Wireshark or tshark.
• Monitor logs of the iApp for crashes or errors related to duplicate xapp_id registration.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting iApp access to only trusted xApps to prevent unauthorized repeated setup requests.

Monitor and limit the volume of E42_SETUP_REQUEST messages to avoid triggering the 16-bit counter wraparound.

Ensure consistent integer widths for xapp_id assignment in the implementation to prevent truncation and duplicate IDs.

Since no upstream fix was available at the time of disclosure, applying network-level controls and monitoring is critical.

Useful 0 Not Useful 0