FlexRIC v2.0.0 fails to bind the xapp_id field from E42 message payloads to the sender's SCTP association, only validating that the xapp_id is within an assigned range. This lack of proper binding allows a remote unauthenticated attacker to impersonate any xApp by specifying arbitrary xapp_id values in requests sent to the iApp on port 36422. As a result, responses can be misrouted to victim xApps, causing state inconsistencies in the red-black tree data structure used internally. These inconsistencies may crash the victim xApp, the RIC, or the iApp itself, leading to denial of service. The vulnerability is tracked as CVE-2026-37235 with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No patches or vendor advisories have been published to date.

The vulnerability allows remote unauthenticated attackers to cause denial of service by crashing victim xApps, the RIC, or the iApp through crafted requests that exploit improper validation of the xapp_id field. There is no impact on confidentiality or integrity, but availability is significantly affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the iApp port (36422) to trusted sources only to reduce exposure. Monitor for unusual crashes or instability in xApps, RIC, or iApp components as potential indicators of exploitation attempts.