The vulnerability exists in FlexRIC 2.0.0 where closing an SCTP association before sending an E2_SETUP_REQUEST triggers an assertion failure. This real‑time RIC implementation incorrectly assumes a mapping between the SCTP association and the E2 node during cleanup, which is enforced by an assert that terminates the process. This violation matches CWE‑617: Improper Control of Resource Consumption, as the software does not validate the existence of the necessary SCTP association before cleanup. An attacker can exploit this by initiating a minimal SCTP handshake on port 36421 and immediately disconnecting; no authentication or E2AP messages are required. The result is a crash of the near‑RT RIC service, which leads to a denial of service for any user relying on that RIC instance.

FlexRIC version 2.0.0 is affected. No other vendors or product variants are listed in the CNA data. Administrators should verify that their deployment uses that specific version and confirm whether any subsequent releases have addressed the issue.

The CVSS score is 7.5, which is considered High, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack does not require authentication and only triggers a crash, the risk is high for availability. The attacker can be a remote adversary with minimal effort, and any exposed FlexRIC instance will be vulnerable until patched or mitigated.