The vulnerability in FlexRIC v2.0.0 arises because the near-RT RIC does not properly handle RIC_INDICATION messages containing ran_func_id values absent from its registry. The lookup returns NULL, which triggers an assert() failure (SIGABRT) in debug builds or a NULL pointer dereference (SIGSEGV) in release builds. This allows a remote unauthenticated attacker to cause a denial of service by crashing the near-RT RIC process via a specially crafted message sent to port 36421. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges or user interaction required, and impact limited to availability.

An unauthenticated remote attacker can cause a denial of service by crashing the near-RT RIC component of FlexRIC v2.0.0. This disrupts service availability but does not impact confidentiality or integrity. There is no indication of code execution or data compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Until a patch is available, consider restricting network access to port 36421 to trusted sources to reduce exposure.