FlexRIC v2.0.0 assigns an xapp_id using a 16‑bit counter but stores the value in 32‑bit message fields. When the counter exceeds 65,530 E42_SETUP_REQUESTs, it wraps around, producing duplicate xapp_ids. The iApp listening on port 36422 attempts to register the duplicate ID, fails to locate it in its internal data structure, and crashes, rendering the application unavailable. This results in a denial of service to clients that rely on the iApp for functionality.

The affected product is FlexRIC v2.0.0. No additional vendor or product names are provided in the CNA data. Attackers can induce the failure by repeatedly connecting to the iApp and sending new xApp registration requests beyond the 65,530 threshold.

The CVSS score of 7.5 reflects a high severity. The EPSS score of < 1% signifies that exploitation prevalence is very low, yet not absent. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires only a persistent connection and repeated registration requests; no special privileges are needed. The iApp will immediately crash when a duplicate xApp ID detected, causing a denial of service for all clients relying on port 36422.