The vulnerability in FlexRIC v2.0.0 arises because the system trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_xapp_id() only ensures the xapp_id is within an assigned range but does not verify the sender's identity. Consequently, a remote unauthenticated attacker can impersonate any xApp by specifying their chosen xapp_id in requests sent to the iApp on port 36422. This impersonation leads to misrouted responses, which can cause crashes in the victim xApp, the RIC, or the iApp itself due to state inconsistencies in the red-black tree data structure managing these interactions. The vulnerability is publicly disclosed but lacks a CVSS score and no patch or remediation level is provided.

An unauthenticated remote attacker can impersonate any xApp by manipulating the xapp_id field, causing misrouting of responses. This can lead to crashes of victim xApps, the RIC, or the iApp due to corrupted internal state, resulting in denial of service conditions. There is no indication of data disclosure or privilege escalation beyond impersonation and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the iApp port (36422) to trusted entities only and monitor for anomalous xapp_id usage patterns. Avoid deploying FlexRIC v2.0.0 in untrusted network environments where unauthenticated attackers could reach the iApp interface.