The vulnerability in FlexRIC v2.0.0 involves reachable assert(0) calls in stub message handlers for certain whitelisted but unimplemented E2AP message types within the near-RT RIC component. An attacker can send a decodable E2AP protocol data unit (PDU) of such a type to the near-RT RIC process on port 36421, which passes whitelist validation but triggers an unconditional assertion failure, causing the process to abort (SIGABRT). This results in a denial of service condition. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability. There is no known patch or vendor advisory detailing remediation at this time.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the near-RT RIC process via an assertion failure. There is no impact on confidentiality or integrity. The availability of the affected component is severely impacted, potentially disrupting services relying on the near-RT RIC.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the near-RT RIC process port (36421) to trusted sources only to reduce exposure. Monitor for unusual crashes or restarts of the near-RT RIC process. No official fix or temporary workaround has been published.