FlexRIC v2.0.0 accepts the xapp_id field in E42 message payloads without verifying that the value belongs to the sender’s SCTP association. The validation routine simply confirms that the id lies within the assigned range, allowing an attacker to fabricate xapp_id values. By impersonating any xApp, the attacker can cause responses to be misrouted to the victim xApp, potentially corrupting the red‑black tree data structure and leading to crashes of the victim xApp, the RIC, or the iApp itself. The vulnerability enables a remote unauthenticated attacker to induce denial of service and instability across the RIC stack.

The affected product is FlexRIC v2.0.0. No other vendors or product variants were listed as impacted.

The vulnerability is exploitable over the internet via the iApp’s listening port (36422). An attacker only needs to send a crafted E42 message containing a chosen xapp_id; no authentication is required. The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation in a typical environment. The CVSS score is 7.5, indicating high severity.