CVE-2026-37231 — HIGH (7.5)

Vulnerability Description

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID in its internal data structure. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Mosaic5G	Flexric	2.0.0

Related Weaknesses (CWE)

CWE-191

References

https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/ExploitMitigationThird Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexricProduct

FAQ

What is CVE-2026-37231?

CVE-2026-37231 is a vulnerability with a CVSS score of 7.5 (HIGH). FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate ...

How severe is CVE-2026-37231?

CVE-2026-37231 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-37231?

Check the references section above for vendor advisories and patch information. Affected products include: Mosaic5G Flexric.