The vulnerability in FlexRIC v2.0.0 involves a reachable assertion failure (CWE-617) in the iApp message dispatcher component. The dispatcher uses assert() to validate incoming E2AP messages against a 9-entry whitelist. If a remote unauthenticated attacker sends any decodable E2AP PDU with a message type outside this whitelist, the assertion triggers, causing the iApp process to abort (SIGABRT). Because the iApp and near-RT RIC run in the same process, this results in the termination of the entire RIC service, leading to disconnection of all E2 Nodes and xApps relying on it. The vulnerability is remotely exploitable without authentication and requires low attack complexity.

Exploitation results in a denial of service condition by crashing the iApp process and terminating the near-RT RIC service. This disrupts connectivity for all E2 Nodes and xApps dependent on the RIC, potentially impacting network operations. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level filtering to block unexpected or malformed E2AP messages targeting port 36422 to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.