The vulnerability exists in FlexRIC 2.0.0 where closing an SCTP association before sending an E2_SETUP_REQUEST triggers an assertion failure. This real‑time RIC implementation incorrectly assumes a mapping between the SCTP association and the E2 node during cleanup, which is enforced by an assert that terminates the process. An attacker can exploit this by initiating a minimal SCTP handshake on port 36421 and immediately disconnecting; no authentication or E2AP messages are required. The result is a crash of the near‑RT RIC service, which leads to a denial of service for any user relying on that RIC instance.

FlexRIC version 2.0.0 is affected. No other vendors or product variants are listed in the CNA data. Administrators should verify that their deployment uses that specific version and confirm whether any subsequent releases have addressed the issue.

The CVSS score is not provided, but the exploit is trivial from a remote location: it only requires network connectivity to the vulnerable port and no credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack does not require authentication and only triggers a crash, the risk is high for availability. The attacker can be a remote adversary with minimal effort, and any exposed FlexRIC instance will be vulnerable until patched or mitigated.