FlexRIC v2.0.0 will crash the iApp process when it receives a duplicate E2_SETUP_REQUEST from the same or spoofed E2 node. The engine uses an assert statement to enforce unique node IDs; when the assertion fails it triggers a SIGABRT, terminating the process. A remote unauthenticated attacker can force this by sending two identical E2_SETUP_REQUESTs, resulting in a denial of service that disrupts traffic management and subscriber services.

The affected component is the FlexRIC iApp server that listens on TCP port 36421. Only FlexRIC version 2.0.0 is known to rely on the assert-based uniqueness check. No other vendor or product versions were identified in the advisory.

The vulnerability, with a CVSS score of 7.5 indicating high severity, is exploitable from any host that can reach port 36421; authentication is not required. Because the attacker only needs to repeat a legitimate E2_SETUP_REQUEST, the attack requires no special credentials or privilege. The risk is a high‑availability impact with no direct confidentiality or integrity compromise. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of immediate exploitation is unclear, but the ease of triggering a crash makes it a significant threat if a patch is not applied.