FlexRIC v2.0.0 contains a vulnerability due to hardcoded assertions that enforce exact IE counts in E2AP message decoding. An attacker can remotely send a valid E2AP PDU with an unexpected number of IEs to trigger a crash (SIGABRT) in the near-RT RIC or iApp components listening on specific ports. The root cause is the failure to properly validate IE counts against allowed protocol ranges, leading to assertion failures and denial of service.

Successful exploitation results in a denial of service condition by crashing the near-RT RIC or iApp processes. The attacker does not require authentication and can cause service disruption remotely. There is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restricting access to the affected ports and monitoring for unusual E2AP traffic may reduce exposure.