付强

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** The iApp message dispatcher contains a reachable assertion. The dispatcher uses the `assert()` function to validate incoming E2AP messages against a 9-entry whitelist. A remote unauthenticated attacker can send a decodable E2AP PDU with a message type not present in the whitelist, triggering a SIGABRT (a signal sent to a process to force it to abort) and crashing the iApp process on port 36422. Because iApp and the near-RT RIC share a single process, this action terminates the entire RIC service, resulting in the disconnection of all xApps and E2 Nodes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.